Fix auth controller auto-registering any wallet address without verification

[Wilfred007]

What

The login endpoint auto-registers any Stellar wallet address as a new EMPLOYEE user with no verification, no email, no organization assignment. New users have organizationId: undefined and can't use any features.

Why

Any Stellar address can register and get a JWT token. There's no invitation flow, no admin approval. The comment says "For demo purposes" but this is in the production controller.

Scope

In scope: Add invitation-based registration, require organization assignment, remove auto-register
Out of scope: Full KYC flow

Acceptance Criteria

• Registration requires valid invitation token
• New users assigned to an organization
• No auto-registration of arbitrary wallet addresses
• Invalid invitation returns 403

Technical Context

• backend/src/controllers/authController.ts lines 163-224 — auto-register
• backend/src/services/authService.ts — auth logic

[diiabblo]

Hi @Wilfred007 — I’d like to take #541.

I’ll remove the demo-style auto-registration path and make invitation acceptance the only route for creating a new
employee account. I’ll trace the controller and auth-service flow so an invitation is validated and consumed atomically,
the user is assigned to the invitation’s organization before any JWT is issued, and arbitrary wallet addresses cannot
create standalone accounts.

I’ll add focused coverage for valid invitation registration, invalid/expired or reused invitations, organization
assignment, and rejection of the existing auto-registration path with the required 403 response. I’ll keep the change
within the stated scope, run the backend test and lint/type-check commands, and include the verification results in the
PR.

Could you please assign #541 to me?

[grantfox-oss]

🦊 GrantFox — @diiabblo has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #541)
2. Your PR will be reviewed by the Protocol-Guild maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

@diiabblo's PR #610 was approved and merged by @Wilfred007.

🏆 @diiabblo: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (236 total points). Track your full progress on GrantFox.

👏 Great work, @diiabblo! Keep contributing to Protocol-Guild.