Invite links: starsync:// opens the app and asks to join; one app per profile; real invite address; clipboard pick-up

- starsync://host:port/?name=&pw= (PROTOCOL.md "Invite link"); the password only when ticked, never in logs
- Linux: launcher entry takes x-scheme-handler/starsync (%u, StartupNotify) and becomes its xdg-mime default; Windows: HKCU\Software\Classes\starsync -> starsync.exe
- InstanceLock: lock file + loopback handoff per profile folder; the running app comes up with the second start's activation token (Wayland/X11) or AllowSetForegroundWindow (Windows)
- Sharing looks up the internet address (HTTPS services with fallbacks); members card picks Internet / Home network / VPN and says when the port needs forwarding
- JoinOffers: link and clipboard prompt with /health, joins through ConnectFlow; dismissed clipboard invites kept as fingerprints

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/core/test/logging_test.dart

@@ -24,6 +24,12 @@ void main() {
       expect(redactLog('http://user:pw@host/x#frag'), 'http://***@host/x');
     });
 
+    test('an invite link keeps its address, never its password', () {
+      expect(redactLog('link starsync://203.0.113.7:8080/?name=Bob&pw=hunter2'),
+          'link starsync://203.0.113.7:8080/?name&pw=***');
+      expect(redactLog('pw=hunter2 port=1'), 'pw=*** port=1');
+    });
+
     test('member tokens in server paths', () {
       expect(redactLog('open http://1.2.3.4:8080/r/default/$tok/2/0/name'), 'open http://1.2.3.4:8080/r/default/***/2/0/name');
       expect(redactLog('ws://h:1/r/default/$tok/source?q=7'), 'ws://h:1/r/default/***/source?q=…');