v0.7.66: provenance logs, nuqs consolidation - #6487

…ed (#6484)

DISABLE_REGISTRATION blocks /signup server-side, but the invite flow, the
login form, the SSO form, and the CLI handoff all kept routing people there,
stranding invited users on a dead end. The flag also never covered OAuth
account creation, so social sign-in still minted accounts for unknown
identities.

… refusal (#6483)

* fix(provenance): report why a projection was refused, at the point of refusal

A refusal fails closed and reaches the user as one fixed sentence. The guard
that caused it may have tripped many frames — or a whole process — earlier, and
the incompleteness latch is one-way, so by then the causing call has long
returned. #6478 recorded the reason when the guard tripped, but marking
early-returns once a registry is already incomplete, so a run that inherits an
incomplete registry refused with nothing recorded anywhere. That is the case
production actually hits.

Retain reasons on the registry and report them where the refusal happens. The
reason is recorded before the already-incomplete return so a causal chain
accumulates, and before the silence checks so a by-design origin that logs
nothing when marked is still nameable at refusal. Propagation inherits through
markIncomplete's source argument, and copying incomplete input paths carries
their reasons, so a fork cannot latch without its cause.

Route all 68 refusal sites through one choke point that logs boundary, cause,
input path and workspace before throwing. It returns never, so callers still
narrow; messages and thrown types are unchanged at every site. Records carry a
cause discriminator, since a latched registry and a caller-side cross-check of
the projection's own output both arrive here and only the former has reasons.

No behaviour change.

* fix(provenance): stop registry-less refusals deduplicating across requests

A refusal with no registry aborts the request rather than iterating, so it
reaches the reporter at most once per request. Remembering it for the process
silenced every later request, including the one being investigated.

* improvement(provenance): inherit copied-path reasons once per copy

Semantics are unchanged — reasons are still inherited only when at least one
incomplete path was actually copied — but the source set is walked once rather
than once per copied path.

* chore(deps): drop the archived image-size dependency

* improvement(content): cover GIF and warn when OG dimensions are unreadable

* improvement(content): read OG dimensions via sharp instead of a bespoke parser

…mirroring it (#6486)

* improvement(url-state): use nuqs setters and derive state instead of mirroring it

Wave 1 of a URL-state audit sweep.

- files: replace the last hand-built same-path query mutation with the nuqs
  group setter, which no longer drops shareFileId/search/type/size/uploaded-by/sort/dir
- suspense: give six page entries their co-located loading.tsx skeleton
  instead of fallback={null}
- invite: derive isNewUser/urlError/token during render so the invitation
  query key is correct on first commit
- resume: derive selectedStatus/queuePosition from the query cache the
  mutation already writes
- verify, logs, terminal: delete dead and duplicate state
- rules: document same-path router.replace as a query mutation, and the
  loading.tsx-as-Suspense-fallback convention

* fix(invite): wait for the stored token before enabling the invitation query

An authenticated user opening an invite without a token in the URL fired the
query with a null token before the effect restored the session-stored one,
producing a transient forbidden state and a redundant request under a second
cache key. Distinguish 'storage not yet read' (undefined) from 'read and empty'
(null) and gate the query on that.