fix(auth): fail closed on reusable invite flags

[tang-vu]

Why this matters

Guest magic links are single-use unless their stored record explicitly enables reuse. Python truthiness made the persisted string false reusable, allowing repeated redemption of a token that the record appeared to mark single-use.

The invariant is: only JSON boolean true makes a guest token reusable. Owner tokens keep their intentional always-reusable contract. A schema-invalid guest value fails closed and is consumed after the first successful redemption.

Overlap check

Searched open and closed PRs for magic link reusable string false and _normalize_record, plus every open PR touching magic_link.py. #2996/#2321 address revoke-prefix ambiguity, #2995 unreadable stores, #2522 expiry validation, #2521 store-root shape, #2413 legacy timestamps, and #2236/#2020 file permissions. None covers the reusable scalar or redemption cardinality. This scope is independent.

Validation

• pytest -q tests/test_magic_link.py (67 passed; 1 framework warning)
• git diff --check

The regression writes a schema-incompatible receipt to the real token store, redeems through /auth/magic-link/{token}, and proves the second redemption returns the same opaque 404 as other invalid links.

Tradeoffs, review, and rollback

This intentionally revokes repeat-use behavior from malformed legacy guest records. Valid reusable booleans and owner-card tokens are unchanged. No store migration is required because normalization applies on read. Because this is an authentication lifecycle change, it should receive independent human review before merge. Rollback is one normalization expression.