Tag the admin Invitations + account Referrals tab descriptors with
module: 'invitations' and pass isModuleActive as resolveSurfaceTabs'
third argument from CoreSurfaceTabBar (the single call site, so every
surface gets the gate). Regenerates src/config/index.js (gitignored
build artifact). Render-time filtering keeps one source of truth
(isModuleActive) instead of pruning at generation time across the 5
merge layers.

refs #4295

Downstream projects overriding admin.tabs/users.extraTabs must tag
module-owned descriptors with the new module field; tabs without it are
always shown.

refs #4295

The Readiness tab already reports mail-provider status ('mail' readiness
row); the admin layout banner duplicated that signal on every admin tab.
Remove the v-alert + showMailerWarning computed + now-unused useAuthStore
import, and delete the orphan AuthAdminMailerWarning snackbar component
(imported only by its own unit test).

refs #4297

Derive the non-ok readiness check count client-side from the admin store and
decorate the built-in readiness tab descriptor with an optional numeric
badge. CoreSurfaceTabBar renders it as a small tonal warning chip after the
label — additive, tabs without a badge render exactly as before, so the
account and organization surfaces sharing the component are unaffected. The
layout fetches readiness on mount only when the store is empty and skips
entirely when landing on the readiness tab, whose view already fetches on
its own mount (child mounted runs first, so an empty-store check alone
cannot prevent the double GET).

refs pierreb-devkit/Node#3836

Mirror the datatable card-title row on the Activity tab: title + spacer +
Clear action + two compact outlined filter fields, debounced 1000ms like the
datatable search (replaces the enter-key + Search-button flow). Gate the
user-ID filter on a client-side ObjectId check since GET /audit 400s on
malformed userId values; dedupe the trailing debounce so Clear does not
double-fetch. max-width stays a Vuetify prop (no inline styles in this view).

refs #4296

POST /invitations/:id/resend mirroring the create/delete error
contract (sanitized banner + rethrow). Pins createInvitation's return
value as the one-time token source for copy-link: the list endpoint
strips tokens, only the create response carries one.

refs pierreb-devkit/Node#3834

After create the dialog stays open showing the signup link once (the
list payload is token-stripped, the create response is the only token
source) with a clipboard copy button — local label flip, no snackbar
(interceptor-only). Paper-plane resend action on pending rows,
single-flight, toasted by the POST interceptor.

refs pierreb-devkit/Node#3834

Surface the signup link once after create in the account Referrals
form (success alert + clipboard button, local Copied label flip).
Same one-time constraint as the admin dialog: the list payload is
token-stripped, only the create response carries the token.

refs pierreb-devkit/Node#3834