chore(release): publish db 0.8.21, cli 0.8.65 and seven in-flight packages

Carries the rollback refusal in db and the matching CLI message, together
with the auth, captcha, csr, dev-server, dev-toolbar, ui and validation
changes that were already in the working tree, since publishing stages
from it and those files would otherwise ship without being recorded here.

  @wrnexus/auth        0.8.28 -> 0.8.29
  @wrnexus/captcha     0.8.15 -> 0.8.16
  @wrnexus/cli         0.8.64 -> 0.8.65
  @wrnexus/csr         0.8.37 -> 0.8.38
  @wrnexus/db          0.8.20 -> 0.8.21
  @wrnexus/dev-server  0.8.60 -> 0.8.61
  @wrnexus/dev-toolbar 0.8.17 -> 0.8.18
  @wrnexus/ui          0.8.75 -> 0.8.76
  @wrnexus/validation  0.8.12 -> 0.8.13

Also declares Event among the browser globals captcha's client asset
already lists, which was the last lint failure, and reformats four files.
typecheck, lint, 1998 tests and format:check all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/auth/test/engine.test.ts

@@ -388,9 +388,14 @@ describe("authentication engine", () => {
       displayName: "Invited User",
       roles: ["member"],
       invitedBy: "admin-user",
+      metadata: { organizationName: "Acme", workspaceName: "Product" },
       baseUrl: "https://example.test",
     });
     expect(messages.at(-1)?.template).toBe("invitation");
+    expect(await engine.inspectInvitation(invitation.token)).toMatchObject({
+      target: "invited@example.com",
+      metadata: { organizationName: "Acme", workspaceName: "Product" },
+    });
     const accepted = await engine.acceptInvitation(invitation.token, {
       password: "StrongPassword123",
     });
@@ -399,6 +404,7 @@ describe("authentication engine", () => {
     expect(
       (await engine.acceptInvitation(invitation.token, { password: "StrongPassword123" })).ok,
     ).toBe(false);
+    expect(await engine.inspectInvitation(invitation.token)).toBeUndefined();
   });
 
   test("customizes delivered token links without application-owned auth APIs", async () => {