feat(constructs): apply the 2026-08-25 library review [spec 0007]

feat: put invite links on hold; single brand header everywhere

Refactor admin page to include collapsible sections and enhance invite link management

Four-tier access model: self-governing admin, pre-login access, audit trail

Admin: no password reset for Google accounts (UI + backend guard)

Admin page v1: user roles (lab tier), password resets, failed-run requeue, verification queue