Stop accepting team invitations through GET requests

[WendellAdriel]

Overview

Accepting a team invitation ran behind a GET route in every teams variant: the Inertia controller performed the writes directly, and the Livewire page accepted from mount(). GET also answers HEAD and skips CSRF, so anything that merely fetched the URL — link prefetchers, mail scanners, HEAD probes — created the membership, marked the invitation accepted, and switched the user's current team. Since #120 the invitation email links to the login page, so nothing needs this URL to be navigable.

Solution

The Inertia kits now expose the accept route as POST — Wayfinder regenerates the action with the new method and router.visit() follows it, so the modals need no changes (decline already works this way as a DELETE). The Livewire kits accept the invitation inside the pending invitations modal action, mirroring decline, and the navigable accept page and its route are gone. The direct-URL browser test was removed; the modal-based test keeps covering the flow end to end.

Fixes #186