refactor: simplify invite interaction and lifecycle orchestration

[xxvcc]

Summary

Default terminal invites now ask for lifetime once: Enter selects 24 hours, a number selects custom hours, and explicit never selects permanence. Account displays share one observation per render, and an upgrade that visibly replaces the executable retires the old menu process even if durability confirmation fails.

Separate invite option parsing and preconditions, share identical timer validation and controlled deletion steps, and consolidate repeated doctor guidance. Existing flags, piped-input behavior, backends, state formats, identity checks, confirmation gates, and recovery rules remain in place. The invite entry point is reduced from 316 to 110 lines; bilingual user documents are updated.

Testing

• Build, vet with ordinary/integration tags, and gofmt passed.
• Complete ordinary and race suites as a non-root user passed: 692 top-level tests each; privileged skips are covered separately.
• Complete serial root integration with race detection passed in a disposable container: 987 top-level tests, 2,288 results including subtests, no test failures or skips.
• Staticcheck with ordinary/integration tags and govulncheck passed. The scanner reports no reachable or imported-package vulnerabilities; the unused openpgp module advisory GO-2026-5932 remains informational.
• Static linux/amd64 and linux/arm64 builds and ELF checks passed.
• Shell syntax, ShellCheck, and 43 mirror receiver tests passed; release/install scripts and workflows are unchanged.
• Chinese and English instructions remain synchronized.

Real Debian 13/systemd/PTY checks covered default/custom/permanent lifetime cancellation and EOF without mutation, a 24-hour account and active timer, SSH login without sudo, SSH refusal after revoke, automatic quarantine finalization, and uninstall cleanup. The upgrade regression covers successful replacement, failure before writing, visible replacement with an injected durability error, and no-op; it verifies write execution, bytes/inode, audit, and menu exit. The durability error is injected after a real atomic write, rather than by failing an actual fsync syscall.

Safety Notes

• No real credentials or invite bundles were committed. Canary private keys stayed inside the disposable container and were destroyed with it.
• Privileged account, SSH, sudo, and systemd behavior was exercised in isolated disposable environments. Test containers and the task image were removed after evidence export.

The accepted 159-file source tree matches the final root test snapshot. Real platform validation covered Debian 13/amd64; ARM64 was cross-built, and the full distribution/reboot matrix was not repeated for this refactor.