feat(hub): open, create and join invitation links in the interface

#/invite takes the link out of the address on load and keeps it in the
tab through registration and sign-in; joining is one click, only the
ticket goes to the hub, and the code goes only to the node the link
names once it has signed its challenge. Members tab gains "Invite by
link" (shared e-mail box, pending list, cancel both halves); home page
takes a pasted link. Browser probe drives the real app, signed out and in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 29 insertions, 2 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index 4dcd81c..861e233 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -3229,7 +3229,7 @@ against T3, it should be that — and it was.
 ### 15.1 Built and running
 
 The hub, the node daemon, both transports, the unified handshake, admission and
-pairing, device linking with member-visible evidence, per-node identity, named roots
+pairing, invitation links, device linking with member-visible evidence, per-node identity, named roots
 with RO/RW and eject/plug, the indexer with partial hashing, uploads, the sealed
 index and sealed upload path, encrypted chat with epochs, video streaming with
 seeking, audio-language and subtitle selection, transfer leases with queueing,
@@ -3264,7 +3264,7 @@ process runs it — `systemctl --user` on Linux, Task Scheduler on Windows.
 | — | DLNA/UPnP casting (§11.4) |
 | — | **Bitmap subtitles** (PGS, VOBSUB — about a fifth of the embedded streams). No WebVTT without OCR; they are not listed rather than listed and blank. Burn-in covers them and costs `-c:v copy`, which is what the eight-slot sizing assumes never happens |
 | — | Delegation (§3.4) |
-| — | **Invitation links** (§3.4, §7.3). The node half (the unbound code, its signed ops, the join path) and the hub half (the ticket bound to a verified address, its mail) are built; the client that creates and reads a link, and the CLI's `--link`, are not |
+| — | **`meshbay-node member invite --link`** (§3.4). Invitation links are built on the node, the hub and the interface; the CLI still issues account codes only |
 | — | Tier 3 roster attestation (§3.3) |
 | — | Android client |
 | — | **Federation between two hubs.** The protocol is written and switched off in the code (§7.6); what is not built is one run between two machines |
diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md
index d7c3430..afe63fd 100644
--- a/docs/USERGUIDE.md
+++ b/docs/USERGUIDE.md
@@ -220,6 +220,24 @@ Someone who runs a node invites you. You need an account on the same hub first.
 
 You will not be asked again on that browser, or on that machine.
 
+### Joining with a link
+
+The person running the group can send you a **link** instead of a code — the
+way in when you have no account yet.
+
+1. **Open the link.** It says *"You have been invited"*.
+2. **Create an account** with the e-mail address the invitation was sent to —
+   exactly that address — or sign in if you already have one. Confirm your
+   address with the code the hub mails you, then sign in.
+3. You are brought back to the invitation: *"… invites you to join …"*.
+   **Join.**
+4. The group opens, and you type no code: the link carried it.
+
+The link works once, and only for the account registered with that address; to
+anyone else it says it was sent to another address. In the desktop
+application, paste the link into **Join with an invitation link** on the home
+page.
+
 **The code never passes through the hub** — unless whoever invited you asked
 the hub to mail it to you — and that is the whole reason it exists: it proves
 the invitation came from the person running the group, and not from the
@@ -549,6 +567,15 @@ membership on the hub and produces a code that never goes near it. Send the
 code out of band; they enter it the first time they open the group. You do not
 need to be online then.
 
+**Inviting someone who has no account yet** is the **Invite by link** box, under
+the first one: type their e-mail address and **Create link**. Send them the
+link, or leave **Send the invitation by e-mail** ticked and the hub mails it.
+They register with that address and land in the group without typing a code.
+The link works once and only for an account with that address, so a copy that
+travels further — a forwarded mail, a chat — lets nobody else in. Pending links
+are listed under the box, and **Cancel** takes one back. A hub mails at most ten
+links a day for one account (an administrator can change that).
+
 The Members tab offers **Send the invitation by e-mail**, ticked by default: the
 hub mails the code to the address on their account, so nobody has to copy it.
 That is a trade: **the hub then holds the code**, and a hub that wanted to could