FX.123 SuperCad Teams: Resend invite, a join code for when email fails, Join with a code (app and /join-team), role changes behind an Apply button

Wrong: the Add people screen said an invited person 'gets an email invite' but nothing was sent, there was no way to resend, and no way to join if the email failed. Changed: TeamJoin (service) makes a 12-character code per invited member (only its sha256 is stored, table team_join_codes, migration 128, 14 days), emails it (Mailer::teamJoinCode, branded) and shows it once on the inviter's screen with Copy, so it can be handed over when email misbehaves; Resend invite makes a new code and the old one stops working. The invited person joins by entering the code AND their email address at /join-team or with Join with a code on the Teams page; they must be signed in with that verified address; the member's row then links to their account and shows Active. Wrong tries are throttled per person (8 / 10 min); a wrong guess never says which part was wrong. Send invite needs a signed-in account and syncs first. Also: a member page's role changes wait for Apply (on only when the pick differs, Undo to go back); the Sync status headings have air above them. Tests: test-user-teams 110, test-super-teams 304, home-teams 31. Untested: a real email through Brevo to a real address, the page with a real signed-in browser session. Not done: the table's role select still changes at once; the migration runner stops at an older migration (country column) so 128 was created from schema.sql; other-language strings.