Invite someone

Invites → Create gives you a /i/<token> link and a QR to send however you like. An invite is server-side state: it can expire, be limited to one use, carry a permission preset, and be revoked. Nothing sensitive rides in the URL itself.