Invite emails for collaborators

Two small improvements to the sharing flow:

• Invite emails. When you add a collaborator, Percher sends

them a heads-up with your name, the app, the role you offered, and what that role can actually do. The link lands them on the accept screen — signed in or not. Before this, a pending invite sat silent until the recipient happened to log in.

• Role-change confirms. Switching a collaborator between

viewer and admin now asks first. Promoting a viewer grants deploy + config access; demoting an admin pulls it back. Both matter enough that we wanted a second click.