feat: Expose settings and defaults for sending invite links [CSR-3677]

[twk3]

I confirmed the invite/reset/mfa flows worked and I was receiving the emails (as long as I made sure to update the from address to be accurate)

---

Summary by cubic

Exposes configurable settings for invitation email delivery (from, BCC, link base URL, expiration) and updates docs/.env examples to prevent DMARC issues. Addresses CSR-3677 by making invite link configuration explicit.

• New Features

  • INVITE_EMAIL_FROM: from address for invite emails
  • INVITE_EMAIL_BCC: BCC for invite emails
  • INVITE_EXPIRATION_DAYS: days until invites expire (default 14)
  • EMAIL_LINKS_BASE_URL: base URL for links in emails (defaults to APP_BASE_URL)

• Migration

  • Set INVITE_EMAIL_FROM to a domain authorized by your SMTP provider
  • Set EMAIL_LINKS_BASE_URL if email links should point to a different host
  • Optionally set INVITE_EMAIL_BCC and INVITE_EXPIRATION_DAYS

^{Written for commit eaf3184. Summary will update on new commits.}

[notion-workspace]

Release on-premise for EPA

[cubic-dev-ai]

No issues found across 3 files