Add private contest invite access and invitee emails

[rsmoke]

Summary

• Private collections stay off the applicant dashboard; each contest instance gets an unguessable /c/:token invite URL with selectable access modes (anyone with the link vs invite email list).
• Entry authorization enforces Private visibility, redeemed tokens, invite-list membership, class level, and entry caps.
• Admins can manage invitees, regenerate links, and email the invite link to newly added invitees or the full list.

Test plan

• Mark a Collection Private and confirm it does not appear on the applicant dashboard
• On a Private contest instance, copy the invite link and open it as an eligible applicant (capability URL mode)
• Switch to invite list mode; confirm non-listed emails are denied and listed emails can submit
• Add invitees and confirm they receive the invite email; use Email all invitees to resend
• Regenerate the invite link and confirm old links stop working
• Confirm Public collections still discover contests via the dashboard without requiring a token

Made with Cursor