Fixed an issue where an SSO-only invitation could be accepted with a
password, creating a local password-authenticated account and
bypassing SSO enforcement. The authentication mode is now derived
solely from the invite. Derive the authentication mode from the invite
record instead of client input during invite acceptance.