The unauthenticated GET /api/workspaces/<slug>/invitations/<pk>/join/
endpoint serialized the invitation with `fields = "__all__"`, exposing
the secret invitation `token` (and an `invite_link` containing it) to
any caller who could guess a workspace slug + invitation id.
Reject GET requests that don't supply the matching `?token=` from the
emailed invite link, comparing in constant time, and additionally strip
`token` and `invite_link` from the response as defense in depth.
Frontend callers (`/workspace-invitations` page, auth header) now thread
the token from the URL through `getWorkspaceInvitation`. Auth pages
visited without an invite token simply skip the invitation banner SWR
call — they have no proof of access and shouldn't see invitation data.
fbb96fc66a