feat(organizations): disable personal account for new users joining via invite

[RSO]

Summary

• Set personal_account_disabled = true for brand-new accounts that are created specifically to accept an organization invite, at the moment they join.
• Existing users who accept an invite keep their current personal_account_disabled value.

Implementation

• acceptOrganizationInvite gains an isNewUser parameter (default false). When a new membership is inserted and isNewUser is true, it updates the user's personal_account_disabled to true within the same transaction. The "already a member" path is unaffected.
• The accept-invite page passes session.isNewUser, which is set at signup time and propagated through the JWT/session, so it is true exactly when the account was just created and false for existing users signing in.

Testing

• pnpm --filter web typecheck
• Added and ran tests in organizations.test.ts covering both the new-user (disabled) and existing-user (unchanged) paths.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the invite-recency heuristic that disables a new user's personal account and found no correctness, security, or migration issues in the changed lines.

Files Reviewed (2 files)

• apps/web/src/lib/organizations/organizations.ts
• apps/web/src/lib/organizations/organizations.test.ts

---

_{Reviewed by claude-sonnet-5-20260630 · Input: 36 · Output: 15.3K · Cached: 1.1M}

_{Review guidance: REVIEW.md from base branch main}