Repair membership and invite state in one transaction

When repairing an email-specific organization join, creating or reactivating membership alone may leave the same invite usable. In one transaction, lock the exact user and organization membership, create or reactivate it with the intended role and cleared deactivation state, then lock and consume the newest still-valid matching invite. After commit, verify membership role, activity, invite state, and authorization.