fix(invites): build share URL on the client, not the server

server/invites.ts derived the share URL from c.req.url — i.e., from
the API request's host. In production the API and SPA share an
origin so this happened to work; in dev where the SPA runs on :5173
and the API on :3000, the generated link pointed at the API
(http://localhost:3000/invite/<token>) which serves nothing.

Fix: the server no longer returns a `url` field. The token is the
canonical artefact; the SPA builds the share link itself via
`${window.location.origin}/invite/${token}`, which is always the
right origin regardless of split-process dev or single-process prod.

  - shared/types.ts: InviteEntry.url removed
  - server/invites.ts: drop originOf() and the URL field in toEntry()
  - frontend Profile.svelte: new inviteUrl() helper; the displayed
    <code> and the clipboard payload both use it
  - tests/social.test.ts: assertion checks token shape instead of
    the URL field

93 tests still pass.

tests/social.test.ts

@@ -119,7 +119,9 @@ describe('invites', () => {
       cookie: inviter.cookie, expect: 201,
     });
     expect(inv.token).toBeTruthy();
-    expect(inv.url).toMatch(/\/invite\/[A-Za-z0-9_-]+/);
+    // URL is built client-side from window.location.origin + the token, so
+    // the server response no longer carries one. Just verify token shape.
+    expect(inv.token).toMatch(/^[A-Za-z0-9_-]+$/);
     expect(inv.claimed_at).toBeNull();
 
     // A new user signs up with that invite token.