Summary

This PR aligns the invite experience with the expected flow:

• Allow invited visitors to preview a library as a guest after opening the shared link.
• After they sign in and verify, server-side logic consumes the invite, creates membership, clears cookies, and returns them to the library (or to profile creation first, then back).

User Flow (expected)

1. Receive invitation
2. Click shared link and view library as guest
3. Click "Join Library"
4. Go to sign-in and enter email
5. Receive verification code via email
6. Enter code
7. Complete profile (if needed)
8. Return to the library as an active member

Implementation

• • If no session but a valid invite cookie matches the collection, do not redirect to ; render the page so they can preview as a guest.
• • New endpoint that reads the httpOnly and cookies, validates the invite, upserts/activates membership, marks invite accepted, clears cookies, and returns .
• • After auth, calls . If it returns a redirect:
    • If the user’s profile is complete → navigate to the collection.
    • If not → navigate to .

Why

• Prevents users from being dropped back into the library as guests after verifying.
• Ensures invites are consumed server-side (cookies cleared, DB membership created) immediately after auth.
• Preserves privacy: preview mode reveals only limited fields and actions until membership is granted.

How to Test

• Generate a invite and open it while signed out.
  • Expect to land on with a guest banner and Join CTA.
• Click "Join Library" and follow the auth code flow.
  • After auth: if profile incomplete, you should be sent to with set.
  • After completing profile: you should land on as a member (no guest banner).
• Repeat while already signed in (not a member): opening should auto-join and land at the collection with a success message.

Notes

• Changes are minimal and targeted; existing privacy constraints in the collections API remain intact for the guest role.