Add configurable onboarding and scoped invitation links

deploy/check-schema.sh

@@ -56,3 +56,9 @@ END $$;
 ROLLBACK;
 SQL
 printf 'Migration preserved existing logins and enforced project isolation.\n'
+CGO_ENABLED=0 go test -mod=readonly -c -o bin/platform-tests ./internal/platform
+docker run --rm --network "container:$container" --user 1000:1000 \
+  --read-only --cap-drop ALL --security-opt no-new-privileges \
+  --mount "type=bind,source=$(pwd)/bin/platform-tests,target=/opt/platform-tests,readonly" \
+  -e PLATFORM_TEST_DATABASE_URL=postgres://postgres@127.0.0.1:5432/postgres?sslmode=disable \
+  --entrypoint /opt/platform-tests postgres:17-alpine -test.v

deploy/release.sh

@@ -66,7 +66,7 @@ fi
 
 docker run -d --name "$candidate" "${codex_mounts[@]}" --network "$network" \
   --env-file "$foundry/database.env" -e HOST -e PORT -e PUBLIC_ORIGIN \
-  -e GOOGLE_CLIENT_ID -e GOOGLE_CLIENT_SECRET -e FOUNDRY_PROJECTS \
+  -e GOOGLE_CLIENT_ID -e GOOGLE_CLIENT_SECRET -e FOUNDRY_PROJECTS -e FOUNDRY_ONBOARDING \
   --user 1000:1000 --cap-drop ALL --security-opt no-new-privileges \
   --read-only --memory 128m \
   --mount "type=bind,source=$release/foundry,target=/opt/foundry,readonly" \