feat(app,learn): invite to a shared studyset by email or link, and join

The apps' half of ADR 0044's step 5 (D37 to D40), on the instance's
half of the commit before.

halkyon_app's SharedSpaceGateway asks for inviting by mail, the
preview of a link, the code proving an address, accepting a mailed
invitation, a space's link (read, switched, joined) and marking a
share seen; SpaceInfo says whether a share is new and who made it,
a member whether they were invited by mail. joinTokenOf reads a link
or its token as pasted. The fake keeps the mails and codes it would
send, for the apps' tests.

In Learn:
- the Owner's Share sheet invites by handle or by email, lists an
  invitation mailed by its role alone, and switches the space's link,
  copying it while on;
- the Library's menu has Join with a link, and a link opened on
  Android (/join/<token> on learn.halkyon.eu, verified through the
  instance's assetlinks) opens the same on a screen of its own: who
  invites and as whom, then Join, or for a mailed invitation the
  address and the code mailed there;
- a studyset someone shared is new until opened: in the Inbox
  ("@alice shared Japanese with you", Open or Leave), on the Profile
  tab's badge and as New on its library card (NewSharesCubit, read
  again after every merge).

Whats-New: Invite people to a shared studyset by email or with a link, join one from the Library's Join with a link, and see in the Inbox what was shared with you.
Whats-New-De: Lade Leute per E-Mail oder Link zu einem geteilten Lernset ein, tritt einem über „Mit einem Link beitreten“ in der Bibliothek bei und sieh im Posteingang, was mit dir geteilt wurde.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/Caddyfile

@@ -55,8 +55,8 @@
 	# Android's statement that Halkyon Learn, signed with the project's key
 	# (tool/release/android-certificate.sha256), may open learn.halkyon.eu's links
 	# itself (App Links): built for ADR 0020's D9, whose correction brings the
-	# sign-in back through the app's scheme instead, and kept, as it costs
-	# nothing. On learn.halkyon.eu alone, the one instance the
+	# sign-in back through the app's scheme instead, and used since by the links to
+	# join a shared studyset (Halkyon's ADR 0044, D39). On learn.halkyon.eu alone, the one instance the
 	# project's builds name: another operator's domain is no link of the project's
 	# app. Written here rather than by the server, which knows no app's key.
 	@assetlinks {