chore(release): publish db 0.8.21, cli 0.8.65 and seven in-flight packages

Carries the rollback refusal in db and the matching CLI message, together
with the auth, captcha, csr, dev-server, dev-toolbar, ui and validation
changes that were already in the working tree, since publishing stages
from it and those files would otherwise ship without being recorded here.

  @wrnexus/auth        0.8.28 -> 0.8.29
  @wrnexus/captcha     0.8.15 -> 0.8.16
  @wrnexus/cli         0.8.64 -> 0.8.65
  @wrnexus/csr         0.8.37 -> 0.8.38
  @wrnexus/db          0.8.20 -> 0.8.21
  @wrnexus/dev-server  0.8.60 -> 0.8.61
  @wrnexus/dev-toolbar 0.8.17 -> 0.8.18
  @wrnexus/ui          0.8.75 -> 0.8.76
  @wrnexus/validation  0.8.12 -> 0.8.13

Also declares Event among the browser globals captcha's client asset
already lists, which was the last lint failure, and reformats four files.
typecheck, lint, 1998 tests and format:check all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/auth/src/engine.ts

@@ -98,6 +98,9 @@ export interface AuthEngine {
     ttlMs?: number;
     baseUrl?: string;
   }): Promise<{ token: string; user: ReturnType<typeof publicUser> }>;
+  inspectInvitation(
+    token: string,
+  ): Promise<{ target?: string; expiresAt: number; metadata: Record<string, unknown> } | undefined>;
   acceptInvitation(
     token: string,
     input: { password?: string; displayName?: string },
@@ -1483,6 +1486,16 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
       return { token, user: publicUser(user) };
     },
 
+    async inspectInvitation(raw) {
+      const token = await inspectToken(raw, "invite");
+      if (!token) return undefined;
+      return {
+        target: token.target,
+        expiresAt: token.expiresAt,
+        metadata: { ...(token.metadata ?? {}) },
+      };
+    },
+
     async acceptInvitation(raw, input) {
       const token = await inspectToken(raw, "invite");
       if (!token)