headscale: device invites — admin surface for offscale enrollment

TODO.md

@@ -119,6 +119,18 @@ day. Kept here for what the policy work turned up, which is not obvious from the
 
 - [x] **Polling** — `useHeadscaleNodes` has had `refetchInterval: 20_000` all along; also stale.
 
+- [x] **Device invites, platform side** (`COMMS/OFFSCALE_INVITE_ENROLLMENT.md` §5, built 2026-08-05).
+      Authorize-new-device form, the one-time link with copy/share/QR, and the invite list with revoke —
+      `/_officer/enroll/invites` in `invites.ts`, `InvitesView`. **The records are not Officer's.** They
+      proxy to the server's Officer Companion, because the joining phone has to claim without an Officer
+      account and this sidecar is loopback-only behind our auth; the spec's own "an invite must work when
+      the platform is down" argument says the same. Officer stores no invite and no claim token.
+      **Waiting on the companion:** `/officer-api/enroll/*` is not deployed anywhere yet, so the section
+      renders its unavailable state. Four gaps were sent back to the spec author: `keys.ts` has no
+      sub-day key TTL for the 5-minute claim key, "the sidecar must refuse plaintext" is unenforceable
+      behind nginx, `tailnet` is not a headscale concept and has to be recorded on the invite, and
+      `/api/v1/enroll/*` collides with headscale's own namespace.
+
 ## Known bugs
 
 - [ ] **`bootstrap.ts` runs `npm install -g` for Pi on every boot.** `findPiPackageDir` checks stale