Various pre-launch fixes.

server/api/invite/accept.post.js

@@ -68,12 +68,14 @@ export default defineEventHandler(async (event) => {
 
   await assignMemberNumber(member._id)
 
-  // Update pre-registration
+  // Update pre-registration. Burning the jti here (instead of in verify) keeps
+  // the verify endpoint idempotent so a page refresh doesn't lock the invitee out.
   await PreRegistration.findByIdAndUpdate(preReg._id, {
     $set: {
       status: 'accepted',
       acceptedAt: new Date(),
       memberId: member._id,
+      magicLinkJtiUsed: true,
     }
   })