fix(auth): Exempt invited SSO signups from required email verification

[nora-shap]

Clicking an org invite link already proves the user owns that inbox, but the auth:email-verification-at-sso-signup gate didn't know about invites: it ran before the invite was ever looked up, so an invited user got forced through a second, redundant verification email.

AuthIdentityHandler._email_verified_via_pending_invite() now folds into the existing is_trusted check: exempt only if the session carries a valid, approved, unexpired invite token (not merely "an invite exists for this email") for a member whose email matches the SSO identity.

Bails if request.user is authenticated and already a member of this org, since ApiInviteHelper's lookup checks membership before the invite cookie and could otherwise resolve the wrong row. An authenticated user who isn't yet a member (an existing Sentry user invited to a different org, declining to merge accounts) still gets the exemption. Fails open on any error, falling back to requiring verification rather than blocking signup.

Note: this duplicates a read _handle_membership() already does later to accept the invite. Left as is (cheap, read only) rather than threading an invite_helper param through three methods for a bounded fix.

[linear-code]

ID-1771

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dd12f5c. Configure here.}

[cursor]

Membership probe skips fail-open handling

Low Severity

_email_verified_via_pending_invite() is documented to fail open on any error, but the authenticated check_membership_by_id probe sits outside the try/except. An RPC or lookup failure there raises out of the newuser path instead of falling back to the verification email, so signup can 500 rather than continue.

 

^{Reviewed by Cursor Bugbot for commit dd12f5c. Configure here.}