fix(auth): complete invited account setup

[puemos]

What changed

• send invited staff and admins directly to a secure password-setup flow
• automatically confirm the account when that password is set
• preserve old confirmation links by forwarding invited users into password setup
• replace CSP-blocked authentication-page resources with local assets
• fall back safely when a new browser session has no valid timezone cookie

Verification

• full invite → set password → sign in again → load overview flow for staff and admin
• legacy invitation confirmation → set password → sign in again
• public registration confirmation remains unchanged
• mix test (426 passed, 1 skipped, 5 excluded)
• mix format --check-formatted
• mix compile --warnings-as-errors

Follow-up to #36.