v3 : dixième relecture — mention « sur invitation », noms attendus protégés

- Tout auteur venu par invitation porte « sur invitation » à côté de son
  nom (propositions, révisions, signalements) : un nom pris avant l'arrivée
  de son titulaire Ğ1, ou une lettre sosie, ne passe pas pour un membre de
  la toile.
- Un lien d'équipe refuse aussi le nom qu'une invitation attend encore.

Boucle : 68 tests Rust, svelte-check, 9 vitest, e2e 13/13.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/ld-server/tests/api.rs

@@ -504,6 +504,21 @@ async fn a_team_link_makes_one_identity_per_opening() {
     let luna = v["me"]["id"].as_str().expect("id").to_owned();
     let (_, g) = first.call("GET", "/api/groups", None).await;
     assert!(g["groups"].as_array().expect("g").iter().any(|g| g["slug"] == "essai" && g["open"] == true));
+    // What an invited person writes says so next to their name.
+    let essai = doc_id(&mut first, "essai").await;
+    let (_, doc) = first.call("GET", &format!("/api/docs/{essai}"), None).await;
+    let uid = unit(&doc, "E2")["id"].as_str().expect("u").to_owned();
+    let (_, v) = first
+        .call("POST", &format!("/api/docs/{essai}/proposals"), Some(json!({
+            "unitId": uid, "title": "Réciprocité", "body": "Je m'engage à ne certifier que des personnes connues.", "submit": true,
+        })))
+        .await;
+    let (_, d) = admin.call("GET", &format!("/api/proposals/{}", v["id"].as_str().expect("id")), None).await;
+    assert_eq!(
+        (d["proposal"]["author"].as_str(), d["proposal"]["authorInvited"].as_bool()),
+        (Some("Luna"), Some(true))
+    );
+    assert_eq!(d["history"][0]["authorInvited"], true);
 
     // Nobody joins under a name already there; the refusal does not count as an opening.
     let mut second = admin.with(None);
@@ -511,6 +526,10 @@ async fn a_team_link_makes_one_identity_per_opening() {
         let (s, v) = second.call("POST", "/api/auth/team", Some(json!({ "token": token, "name": taken }))).await;
         assert_eq!((s, v["error"].as_str()), (StatusCode::CONFLICT, Some("name_taken")), "{taken}");
     }
+    // Nor under the name an invitation still waits for.
+    admin.call("POST", "/api/access/invitations", Some(json!({ "label": "Chiara Rossi", "groups": ["essai"] }))).await;
+    let (s, v) = second.call("POST", "/api/auth/team", Some(json!({ "token": token, "name": "chiara rossi" }))).await;
+    assert_eq!((s, v["error"].as_str()), (StatusCode::CONFLICT, Some("name_taken")));
     // Look-alike letters from other alphabets are not a name.
     let (s, v) = second.call("POST", "/api/auth/team", Some(json!({ "token": token, "name": "Lunа" }))).await;
     assert_eq!((s, v["error"].as_str()), (StatusCode::BAD_REQUEST, Some("name")));