fix(relay): keep invite links usable without web bundle

[ttizze]

Summary

• Serve /invite/{code} as an explicit relay route so invite links no longer return 404 when BUZZ_WEB_DIR is unset.
• Preserve the full SPA landing page when a web bundle is configured; otherwise return a small page that opens buzz://join with the request host and invite code.
• URL-encode the deep-link parameters and add no-store, CSP, referrer-policy, and nosniff response headers.

Related issue

None found. Searched the existing issues and pull requests for invite links failing without a web bundle and for /invite 404s.

Testing

• cargo fmt --check
• cargo test -p buzz-relay 'router::tests::'
• cargo clippy -p buzz-relay --all-targets -- -D warnings
• just ci
• just test-integration

Manual reproduction covered by this change:

1. Start a relay without BUZZ_WEB_DIR.
2. Open /invite/{code} on the relay host.
3. Before: the route falls through to a 404 because the SPA fallback is only installed when a web directory exists.
4. After: the relay returns an HTML landing page whose primary action opens the Buzz app with the relay URL and invite code.