fix: handle invitations in social and SAML auth

- Preserve invitation callbacks through social and SAML login
- Accept invited users without creating a default tenant
- Add regression coverage for invitation acceptance flows

ui/app/api/auth/callback/github/route.ts

@@ -3,15 +3,24 @@
 import { NextResponse } from "next/server";
 
 import { signIn } from "@/auth.config";
+import {
+  getInvitationTokenFromCallbackPath,
+  getSafeCallbackPath,
+} from "@/lib/auth-callback-url";
 import { apiBaseUrl, baseUrl } from "@/lib/helper";
 
 export async function GET(req: Request) {
   const { searchParams } = new URL(req.url);
 
   const code = searchParams.get("code");
+  const callbackPath = getSafeCallbackPath(searchParams);
+  const invitationToken = getInvitationTokenFromCallbackPath(callbackPath);
 
   const params = new URLSearchParams();
   params.append("code", code || "");
+  if (invitationToken) {
+    params.append("invitation_token", invitationToken);
+  }
 
   if (!code) {
     return NextResponse.json(
@@ -37,18 +46,19 @@ export async function GET(req: Request) {
     const { access, refresh } = data.data.attributes;
 
     try {
+      const redirectPath = invitationToken ? "/" : callbackPath;
       const result = await signIn("social-oauth", {
         accessToken: access,
         refreshToken: refresh,
         redirect: false,
-        callbackUrl: `${baseUrl}/`,
+        callbackUrl: new URL(redirectPath, baseUrl).toString(),
       });
 
       if (result?.error) {
         throw new Error(result.error);
       }
 
-      return NextResponse.redirect(new URL("/", baseUrl));
+      return NextResponse.redirect(new URL(redirectPath, baseUrl));
     } catch (error) {
       console.error("SignIn error:", error);
       return NextResponse.redirect(