feat(email): write to people in their own language (E9.5 S7)

Twelve mails carried hardcoded English while the app itself has enforced HU/EN parity since E5.
A mail is the one user-facing surface nobody can re-render by switching the UI language: it arrives
once, in whatever language we picked, and stays that way. That made the epic's own headline mail —
"one mail, one click" — English for a Hungarian reader.

The text moved to a catalog (`mailtext.py`) with a `text(key, lang, **vars)` renderer, and the parity
rule is now a test rather than a habit: every key must carry both languages AND the same
`{placeholders}`. A translation that drops `{link}` sends a mail with no link in it; one that invents
a placeholder raises inside a background task nobody is watching. Both are silent in production.

Every `send_*` takes the language as its second argument, resolved by the REQUEST handler and never
inside the mail — these all run as background tasks, after the request's session is gone, which is
the same reason the approval mail computes its link in the handler.

Where the language comes from, in order: the account's own preference; failing that, the language the
person asked us in; failing that, English. The middle one is new — `invites.lang`, migration `0082` —
because the mails an access request produces go to an address that usually has no account yet, and
the signal does exist: the page their form was submitted from, or the locale Google reported for a
sign-in we refused. Captured rather than derived, for the third time in this epic (`google_email` in
S3, `preferences.language` in S6 taught the same lesson): a signal that exists only in one moment
cannot be backfilled later. So the admin is asked in exactly one place — the invitation to an address
they typed in themselves, where nobody has ever told us anything.

That send is now a dialog rather than a bare click, which is also where the "you already wrote to
them" warning belongs — it used to live only in a tooltip the admin may never hover, guarding the one
action whose failure mode is mailing a real person twice.

S6's registration `lang` field turned out to be dead on arrival: the backend accepted it, the
frontend never sent it, so every account has been storing nothing. The request builders now stamp the
UI language themselves — a signal that has to be passed in by every caller is one every caller can
forget, which is exactly how it shipped unset.

Admins are notified one mail per language group instead of one blast to everyone. They are people
with their own UI language; a single message would have to pick one of them and be wrong for the rest.

Also removes a duplicated `invited_at` column declaration on `Invite` (two identical definitions
landed in S6).

backend/app/routes/admin.py

@@ -11,6 +11,7 @@ from sqlalchemy.orm import Session
 
 from app import audit
 from app import email as email_mod
+from app import mailtext
 from app.audit import AuditAction
 from app.auth import (
     admin_user,
@@ -81,6 +82,10 @@ def _serialize(inv: Invite, *, has_account: bool = False) -> dict:
         # …and whether removing it would actually take access away, or leave the env allow-list
         # granting it anyway (for an ADMIN_EMAILS address, as an admin).
         "still_allowed_by_env": _env_allowed(inv.email),
+        # The language this person asked us in, or null when nobody ever told us (a hand-added
+        # whitelist row). The invitation dialog preselects it, and falls back to the admin's own UI
+        # language — a guess, but a visible one the admin can correct before sending.
+        "lang": inv.lang,
     }
 
 
@@ -192,7 +197,8 @@ def approve_invite(
     # the task must not outlive it. Approval answers a request the person MADE, so unlike the
     # invitation below it is sent automatically — a reply is owed, not a nudge.
     link, has_account, hours = _welcome_mail_parts(db, inv.email)
-    background.add_task(email_mod.send_access_approved, inv.email, link, has_account, hours)
+    lang = mailtext.lang_for_email(db, inv.email)
+    background.add_task(email_mod.send_access_approved, inv.email, lang, link, has_account, hours)
     return _serialize(inv, has_account=bool(_accounts_for(db, [inv.email])))
 
 
@@ -206,7 +212,9 @@ def deny_invite(
     # Symmetry with approve: the requester hears back either way, instead of a silent limbo. No
     # account is activated, so this is an email only (the requester has no in-app inbox yet).
     inv = _decide(db, invite_id, admin, approved=False)
-    background.add_task(email_mod.send_access_denied, inv.email)
+    background.add_task(
+        email_mod.send_access_denied, inv.email, mailtext.lang_for_email(db, inv.email)
+    )
     return _serialize(inv, has_account=bool(_accounts_for(db, [inv.email])))
 
 
@@ -244,10 +252,18 @@ def add_invite(
     return _serialize(inv, has_account=bool(_accounts_for(db, [email])))
 
 
+class InviteSendIn(BaseModel):
+    # Which language to write this person in. Optional so an existing caller (and a test) can post
+    # an empty body, but the admin UI always sends it: this is the one recipient the app has no
+    # signal about, because the admin typed the address in themselves.
+    lang: str | None = None
+
+
 @router.post("/invites/{invite_id}/invite")
 def send_invitation(
     invite_id: int,
     background: BackgroundTasks,
+    body: InviteSendIn | None = None,
     admin: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
@@ -273,6 +289,14 @@ def send_invitation(
         # never sent.
         raise HTTPException(status_code=409, detail={"code": "invite_send", "reason": "email_off"})
     link, has_account, hours = _welcome_mail_parts(db, inv.email)
+    # An explicit pick from the dialog is recorded, so a later mail to this address matches the one
+    # the admin already sent. Only the explicit pick — writing the fallback back would turn a column
+    # that means "what this person told us" into "what we last guessed".
+    picked = body.lang if body else None
+    if picked in mailtext.SUPPORTED:
+        lang = inv.lang = picked
+    else:
+        lang = mailtext.lang_for_email(db, inv.email)
     inv.invited_at = datetime.now(timezone.utc)
     audit.record(
         db,
@@ -283,7 +307,7 @@ def send_invitation(
         summary=inv.email,
     )
     db.commit()
-    background.add_task(email_mod.send_access_invitation, inv.email, link, has_account, hours)
+    background.add_task(email_mod.send_access_invitation, inv.email, lang, link, has_account, hours)
     return _serialize(inv, has_account=has_account)
 
 
@@ -400,7 +424,13 @@ def set_user_role(
     target.role = role
     db.commit()
     if changed:
-        background.add_task(email_mod.send_role_changed, target.email, role, operator_contact())
+        background.add_task(
+            email_mod.send_role_changed,
+            target.email,
+            mailtext.lang_for_user(target),
+            role,
+            operator_contact(),
+        )
     return _serialize_user(target)
 
 
@@ -449,7 +479,12 @@ def set_user_suspended(
     target.is_suspended = suspended
     db.commit()
     if was_suspended and not suspended:
-        background.add_task(email_mod.send_account_unsuspended, target.email, operator_contact())
+        background.add_task(
+            email_mod.send_account_unsuspended,
+            target.email,
+            mailtext.lang_for_user(target),
+            operator_contact(),
+        )
     return _serialize_user(target)