feat(m5c): onboarding — DB invites, request-access, admin approval, email

Move the access whitelist from the ALLOWED_EMAILS env var into a DB Invite table
(env kept as bootstrap fallback), and add a self-service request + admin approval
flow with fail-soft email.

- models: Invite(email, status pending|approved|denied, requested_at, decided_*)
- migration 0008: invites table; seed env ALLOWED_EMAILS u ADMIN_EMAILS as approved
- auth: is_allowed() (DB-first, env fallback); a denied Google login records a pending
  request and bounces to /?access=requested instead of a raw 403; public POST
  /auth/request-access; upsert is idempotent so repeats don't re-spam admins
- routes/admin.py (admin-only): list/approve/deny invites + manual add
- email.py: smtplib + Gmail App Password, fail-soft (skips if SMTP unset)
- /api/me exposes pending_invites; config + .env.example gain SMTP_*
- UI: Login 'Request access' form + access=requested/denied handling; Settings ->
  Access requests (approve/deny + add); admin nudge toast on pending requests

Verified locally: request-access creates a pending invite and emails the admin;
seed approved npeter83; guinea-pig yt.trash2023 denied until approved.

frontend/src/App.tsx

@@ -15,7 +15,7 @@ import {
   saveLayoutLocal,
   type SidebarLayout,
 } from "./lib/sidebarLayout";
-import { configureNotifications } from "./lib/notifications";
+import { configureNotifications, notify } from "./lib/notifications";
 import { setHintsEnabled } from "./lib/hints";
 import Login from "./components/Login";
 import Header from "./components/Header";
@@ -104,6 +104,15 @@ export default function App() {
     if (typeof prefs.hints === "boolean") setHintsEnabled(prefs.hints);
     if (typeof prefs.performanceMode === "boolean")
       document.documentElement.dataset.perf = prefs.performanceMode ? "1" : "";
+    // Nudge admins when access requests are waiting (in lieu of a server-push bell).
+    const pending = meQuery.data?.pending_invites ?? 0;
+    if (meQuery.data?.role === "admin" && pending > 0) {
+      notify({
+        level: "warning",
+        title: "Access requests",
+        message: `${pending} pending — review in Settings → Account.`,
+      });
+    }
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [meQuery.data?.id]);