Render a preview of the invitation email

Renders the invitation email through the SAME code path a real send uses — the shared template, the tenant's branding, and the same token expansion — so the preview cannot drift from what actually ships. `slots` is an optional UNSAVED draft layered over the currently effective copy; omit it to preview exactly what is being sent today. The draft is NEVER persisted. A draft that violates the slot contract is reported in `validation_errors` and the response falls back to previewing the saved copy, so the admin still sees what is going out while they fix the field. The accept link uses the same non-redeemable sentinel token as a test send. Caller must hold `tenant.settings.write`. Plan 2026-07-27-tenant-configurable-invitation-email / T007.

curl -X POST "https://example.com/v1/admin/settings/email-template/preview" \  -H "Content-Type: application/json" \  -d '{    "slots": {      "intro": "Welcome to {{brand}} — glad you\'re here."    }  }'

{
  "subject": "string",
  "html": "string",
  "text": "string",
  "source": "tenant",
  "validation_errors": [
    {
      "field": "string",
      "message": "string"
    }
  ]
}

{
  "error": "validation_failed",
  "message": "request body is invalid",
  "request_id": "req_01abc126"
}

{
  "error": "unauthenticated",
  "message": "missing or invalid bearer token",
  "request_id": "req_01abc123"
}

{
  "error": "permission_denied",
  "message": "caller does not hold the required permission",
  "request_id": "req_01abc124"
}