Auth and provisioning patch

Paid tier flags removed from CLI. vault auth create now prompts for a claim code directly — tier is resolved server-side. --basic and --high fail with an explicit error pointing to the correct form.

Email backend switched from SMTP to Resend. Sender remains [email protected]. DNS (SPF, DKIM, DMARC) required before sending.

Added vault admin invite send <email>: generates a 14-day single-use trial invite and delivers it in one command. No operator manual shuffle required.