feat(web): settings invite over stock route, models tab, people table fits (CL-8503)

[TheGreatAxios]

Summary

• People: added an Invite dialog (email, role) over the stock POST /api/tenants/:t/members/invite route (createInviteRoutes, InviteMember type) — a useMutation that invalidates the people query on success. The route requires the invited email to already have a platform account; there is no invite-by-email-only path, so the dialog surfaces that constraint in its copy.
• Models: added a read-only Settings tab listing this workbench's providers (GET /api/tenants/:t/providers) and its resolved model catalog (GET /api/tenants/:t/models, createModelDiscoveryRoutes), reusing listProviders from credentials-api.ts and getResolvedCatalog from settings/inference. Each model's offerings are shown in resolution-priority order with the first (lowest priority) offering marked Default.
• People table: wrapped in a .settings-table-scroll overflow container so the Actions column no longer overflows the panel at desktop width; the table scrolls horizontally instead of the panel widening or clipping.

Routes checked for part 1: vendor/intx/hub-api/src/routes/principals.ts (createInviteRoutes, mounted at /api/tenants/:tenantId/members/invite in app.ts) — a stock invite route exists, so it's used as-is; no custom path was built.

Test plan

• bunx tsc -p apps/web --noEmit
• bun run lint
• bun run fmt
• cd apps/web && bun run build
• cd apps/web && bun test ./src (582 pass)

[linear-code]

CL-8503