fix: restrict email invite metadata lookup (#15150)

## Summary

This change restricts email invitation metadata lookup to the
authenticated user that the invitation was issued to.

## Impact

The public invite-info resolver returns workspace, owner, invitee, and
status details for a valid invitation identifier. For email invitations,
that information should only be returned to the intended recipient after
authentication.

## Fix

- Keep existing link-invitation behavior unchanged.
- For email invitations, require an authenticated user whose id matches
the invitation recipient before returning invitation details.
- Return the existing invalid-invitation error for mismatched or
unauthenticated access.

## Validation

- `git diff --check`
- Full test/lint suite was not run locally because dependencies are not
installed in this checkout.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Tightened invitation access checks so non-link invites are only
readable by the intended recipient.
* Invalid or missing user context now returns an error earlier,
preventing access to invite details when the invitation doesn’t match.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: failsafesecurity <190101117+failsafesecurity@users.noreply.github.com>
Co-authored-by: DarkSky <25152247+darkskygit@users.noreply.github.com>

packages/backend/server/src/core/workspaces/resolvers/member.ts

@@ -566,6 +566,11 @@ export class WorkspaceMemberResolver {
   ): Promise<InvitationType> {
     const { workspaceId, inviteeUserId, isLink } =
       await this.workspaceService.getInviteInfo(inviteId);
+
+    if (!isLink && (!user || user.id !== inviteeUserId)) {
+      throw new InvalidInvitation();
+    }
+
     const workspace = await this.workspaceService.getWorkspaceInfo(workspaceId);
     const owner = await this.models.workspaceUser.getOwner(workspaceId);