[Bccorb]

Part of fells-code/seamless-auth-api#338 (epic fells-code/seamless-auth-api#334).

After an import, the remaining work is getting everyone onto a passkey, ideally two authenticators each. These are the schemas for seeing who has enrolled and for inviting the rest.

Changes

• Enrollment list:
  • EnrollmentStatusSchema (none, one, two_or_more), counted in WebAuthn credentials. TOTP does not count.
  • AdminEnrollmentQuerySchema: pagination, plus organizationId, status, imported and search.
  • AdminEnrollmentResponseSchema: a per-status summary that ignores the status filter, the filtered users, and total. This also feeds the coverage report in #178.
• Invites:
  • EnrollmentInviteRequestSchema takes exactly one of userIds (up to 200) or organizationId, plus status (none or one, default none) and an optional signInUrl validated like other redirect targets.
  • EnrollmentInviteResponseSchema reports sent, skipped, remaining (organization-wide calls only) and a result per user, with a skip reason and an external delivery.
  • The invite is a notice that links to the normal sign-in page. It carries no credential.
• AuthDeliverySchema: new enrollment_invite_email kind (to, signInUrl), for external delivery mode.
• AUTH_EVENT_TYPES: admin_enrollment_invite_sent.
• SystemConfigSchema.prompt_passkey_enrollment (default false), also patchable. With it set, email or phone code sign-ins (OTPVerifyTokenSuccessSchema) and magic link sign-ins (MagicLinkPollSuccessSchema) carry nextStep: 'enroll_passkey' for a user with no passkey. That is what sends an invited user into enrollment after they sign in.
• NextStepSchema is now shared with OAuthLoginSuccessResponseSchema.

Downstream

• Nothing in the org switches exhaustively over the delivery kind. seamless-auth-server's deliverAuthMessage has no exhaustive check and pins types ^0.4.0 (server#169).
• The new message itself is feat(core): add an enrollment invite email seamless-auth-messaging#6.

Checks

npm run typecheck, npm run lint, npm run format:check, npm test (276, 11 new) and npm run build pass.