The workspace join endpoint previously accepted invitations based only on
email matching without verifying that the request came from the actual
email recipient. This allowed attackers to accept invitations for any
email by simply providing the email in the request.
Changes:
- Replace email-based validation with token-based validation
- Token is now included in invitation URL instead of email
- Backend validates token matches stored invitation token
- Frontend passes token from URL to API instead of email
