feat(scheduling): add explicit invitation link lifecycle

README.md

@@ -179,16 +179,32 @@ frontend handoff rather than a working guest page. The token is never moved into
 query parameters, browser storage, or an authenticated API contract while that
 shell boundary is unresolved.
 
-Draft saves never issue public tokens or enqueue invitation delivery, even when
-`create_participant_invitations` is left at its compatibility default. A
-collecting request may explicitly issue invitations; authenticated in-module
-responses lazily create a gateway-bound invitation and discard its token. The
-draft-to-open transition therefore supports authenticated lazy responses, but
-does not make a guest link available from the current UI. The product decision
-still open is the explicit organizer workflow for issuing or reissuing public
-links after a draft is opened and, when Mail is installed, whether that action
-should also enqueue delivery or return links for separate distribution. Until
-that workflow is agreed, opening a draft does not silently send anything.
+Creating, editing, and opening a request never issue public tokens or enqueue
+invitation delivery. The deprecated `create_participant_invitations` request
+field remains accepted for compatibility, defaults to `false`, and has no side
+effect. Authenticated in-module responses can still lazily create a
+gateway-bound invitation whose token is discarded.
+
+Organizers and Scheduling administrators use the participant-specific
+invitation action instead:
+
+- `POST /scheduling/requests/{request_id}/participants/{participant_id}/invitation`
+  with `{"action":"copy"}` rotates the previous invitation and returns the new
+  relative action URL once. The response is marked `no-store`.
+- The same endpoint with `{"action":"send"}` rotates the invitation and passes
+  its URL directly to the notification dispatch job. Neither the API response
+  nor Scheduling's durable notification projection contains the token.
+- `DELETE` on the same resource revokes the active link immediately; exact
+  repeats are idempotent.
+
+Links can be issued in any request state. Collection state and deadline checks
+remain independent submission requirements, so a link to a draft, closed, or
+decided request is read-only. Issue, copy, send-request, and revoke actions are
+audited with request and participant identifiers but never a bearer token.
+Only an organizer (under the ordinary Scheduling write policy) or a tenant-wide
+Scheduling administrator can use these actions. If notification delivery is
+not installed, `send` fails before rotating the current link and the organizer
+can use `copy` for separate distribution.
 
 ## FieldLabel omission register