Implement Issue #1: User Accounts & Profiles

- Admin-only account creation (no self-registration); invite-token flow
  replaces the public /auth/register endpoint
- New volunteer fields: phone, is_trainee, operational_roles,
  notification_preference, admin_notes, last_login, completed_shifts
- Role-scoped profile editing: volunteers update name/phone only;
  admins update all fields including notes and trainee flag
- /auth/activate endpoint for invite-token-based account activation
- /api/v1/volunteers/{id}/invite for admin to resend invite links
- last_login recorded on each successful authentication

Tests:
- Go: handler tests (auth rules, create, activate, update scoping) via
  Storer/AuthServicer interfaces and fake store; auth unit tests for
  HashPassword, IssueToken, and Parse
- Frontend: RTL tests for Activate, Profile, and Volunteers pages
- Fixed CRA 5 + React Router v7 Jest compatibility (moduleNameMapper +
  TextEncoder polyfill)
- Replaced stale CRA App.test.tsx placeholder with real tests

CI:
- .gitea/workflows/ci.yml runs go vet, go test, tsc, and npm test on
  every push and pull request

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/src/pages/Activate.test.tsx

@@ -0,0 +1,92 @@
+import React from 'react';
+import { render, screen, fireEvent, waitFor } from '@testing-library/react';
+import { MemoryRouter, Route, Routes } from 'react-router-dom';
+import Activate from './Activate';
+import { api } from '../api';
+import { AuthProvider } from '../auth';
+
+jest.mock('../api', () => ({
+  api: {
+    activate: jest.fn(),
+  },
+}));
+
+const mockActivate = api.activate as jest.Mock;
+
+function renderActivate(token = 'valid-token') {
+  return render(
+    <AuthProvider>
+      <MemoryRouter initialEntries={[`/activate?token=${token}`]}>
+        <Routes>
+          <Route path="/activate" element={<Activate />} />
+          <Route path="/login" element={<div>Login Page</div>} />
+        </Routes>
+      </MemoryRouter>
+    </AuthProvider>,
+  );
+}
+
+beforeEach(() => {
+  mockActivate.mockReset();
+});
+
+test('renders password fields', () => {
+  renderActivate();
+  expect(screen.getByLabelText(/^password$/i)).toBeInTheDocument();
+  expect(screen.getByLabelText(/confirm password/i)).toBeInTheDocument();
+  expect(screen.getByRole('button', { name: /activate account/i })).toBeInTheDocument();
+});
+
+test('shows error when no token in URL', () => {
+  render(
+    <AuthProvider>
+      <MemoryRouter initialEntries={['/activate']}>
+        <Routes>
+          <Route path="/activate" element={<Activate />} />
+        </Routes>
+      </MemoryRouter>
+    </AuthProvider>,
+  );
+  expect(screen.getByText(/no invite token/i)).toBeInTheDocument();
+});
+
+test('shows error when passwords do not match', async () => {
+  renderActivate();
+  fireEvent.change(screen.getByLabelText(/^password$/i), { target: { value: 'password1' } });
+  fireEvent.change(screen.getByLabelText(/confirm password/i), { target: { value: 'password2' } });
+  fireEvent.click(screen.getByRole('button', { name: /activate account/i }));
+  expect(await screen.findByText(/passwords do not match/i)).toBeInTheDocument();
+});
+
+test('shows error when password too short', async () => {
+  renderActivate();
+  fireEvent.change(screen.getByLabelText(/^password$/i), { target: { value: 'short' } });
+  fireEvent.change(screen.getByLabelText(/confirm password/i), { target: { value: 'short' } });
+  fireEvent.click(screen.getByRole('button', { name: /activate account/i }));
+  expect(await screen.findByText(/at least 8 characters/i)).toBeInTheDocument();
+});
+
+test('calls api.activate and navigates to login on success', async () => {
+  mockActivate.mockResolvedValueOnce({ id: 1, name: 'Alice' });
+  renderActivate('valid-token');
+
+  fireEvent.change(screen.getByLabelText(/^password$/i), { target: { value: 'goodpassword' } });
+  fireEvent.change(screen.getByLabelText(/confirm password/i), { target: { value: 'goodpassword' } });
+  fireEvent.click(screen.getByRole('button', { name: /activate account/i }));
+
+  await waitFor(() => {
+    expect(mockActivate).toHaveBeenCalledWith('valid-token', 'goodpassword');
+  });
+  expect(await screen.findByText(/login page/i)).toBeInTheDocument();
+});
+
+test('shows error when api.activate fails', async () => {
+  mockActivate.mockRejectedValueOnce(new Error('invalid or expired invite token'));
+  renderActivate('bad-token');
+
+  fireEvent.change(screen.getByLabelText(/^password$/i), { target: { value: 'goodpassword' } });
+  fireEvent.change(screen.getByLabelText(/confirm password/i), { target: { value: 'goodpassword' } });
+  fireEvent.click(screen.getByRole('button', { name: /activate account/i }));
+
+  expect(await screen.findByText(/invalid or expired invite token/i)).toBeInTheDocument();
+});