feat(auth)!: remove the public access-request endpoint

POST /auth/request-access had no caller left: the login page's form was
gone, and registration and a refused Google sign-in already land in the
same admin approval. A third public write path with no protection of
its own (owner decision, E34).

Its one guard moves to where every path passes: upsert_pending_invite no
longer opens a pending row for an address the env already lets in. The
registration path lacked it — registering b.ob@gmail.com beside an
env-granted bob@gmail.com opened a pending row, and is_allowed answers
from the invite rows once any exist, so the real owner was locked out.
The tests that drove the endpoint now drive registration or the shared
function.

frontend/src/lib/api/auth.ts

@@ -127,14 +127,7 @@ export const authApi = {
       { quiet: true },
     ),
 
-  // --- onboarding: access requests + demo entry ---
-  // Same reasoning as register: the requester has no account to carry a language preference, so the
-  // page they asked from is what decides the language of the approval or denial mail.
-  requestAccess: (email: string): Promise<{ status: string }> =>
-    req("/auth/request-access", {
-      method: "POST",
-      body: JSON.stringify({ email, lang: uiLang() }),
-    }),
+  // --- onboarding: demo entry ---
   // Hidden demo entry: a whitelisted email logs into the shared demo account, no Google
   // sign-in. Returns whether a session was established.
   demoLogin: (email: string): Promise<{ authenticated: boolean }> =>