fix(auth): validate invitation magic link tokens

Accept invitation links across configured public origins while still
rejecting stored invitations whose token no longer matches.

config/constants.php

@@ -86,7 +86,6 @@ return [
 
     'invitation' => [
         'link' => [
-            'base_url' => '/invitations/',
             'expiration_days' => 3,
         ],
     ],