fix(auth): honor explicit ?inviteCode= before the offboard guard on the root page

cubic review (CS-569, P2): the centralization refactor made the root page
short-circuit offboarded users to /auth/access-removed before the /setup
passthrough, so an explicit ?inviteCode= on / was swallowed for offboarded
users — a regression from the prior behavior where 0-org users fell through
to /setup (which hands the code to /invite downstream).

Restore invite-first precedence: when ?inviteCode= is present, redirect to
/setup (preserving the code) so the downstream /invite handling runs, before
applying the offboard guard. Mirrors the /setup route precedence.

Adds a regression test: offboarded + ?inviteCode= -> /setup (not access-removed).

Refs: CS-569

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M6zcF9bvPP1UwZgzK21cw1

Author: tofikwest

apps/app/src/app/page.test.tsx

@@ -79,6 +79,18 @@ describe('RootPage onboarding-loop guard (CS-569)', () => {
     expect(mockRedirect).not.toHaveBeenCalledWith('/auth/access-removed');
   });
 
+  it('lets an explicit ?inviteCode= win over the offboard guard (hands off to /setup for downstream invite handling)', async () => {
+    // Regression (cubic P2): an offboarded user landing on /?inviteCode=... must
+    // still be able to accept the invite, not be short-circuited to access-removed.
+    mockMe({ organizations: [], pendingInvitation: null, hasInactiveMembership: true });
+
+    await expect(
+      Page({ searchParams: Promise.resolve({ inviteCode: 'inv_abc' }) }),
+    ).rejects.toThrow('REDIRECT:/setup?inviteCode=inv_abc');
+
+    expect(mockRedirect).not.toHaveBeenCalledWith('/auth/access-removed');
+  });
+
   it('prefers a pending invitation over the access-removed page', async () => {
     mockMe({
       organizations: [],

apps/app/src/app/page.tsx

@@ -59,9 +59,16 @@ export default async function RootPage({
   const memberships = meRes.data?.organizations ?? [];
 
   if (memberships.length === 0) {
-    // CS-569: route a user with no active org through the shared decision so
-    // this page and the /setup route can't diverge (invite > offboarded > new).
-    // `null` = genuinely new user → onboarding.
+    // An explicit ?inviteCode= (the user is accepting a specific invitation)
+    // always wins over the offboard guard: hand off to /setup, which preserves
+    // the code and passes it through to /invite downstream. Mirrors the /setup
+    // route precedence so an offboarded user can still accept a valid invite.
+    const inviteCode = (await searchParams)?.inviteCode;
+    if (inviteCode) {
+      return redirect(await buildUrlWithParams('/setup'));
+    }
+    // Otherwise route via the shared decision (pending invite > offboarded >
+    // new user). `null` = genuinely new user → onboarding.
     const target = resolveNoActiveOrgRedirect(meRes.data);
     return redirect(await buildUrlWithParams(target ?? '/setup'));
   }