Add user feature permissions and unified account management

backend/app/routers/auth.py

@@ -1,3 +1,4 @@
+from ..feature_guards import require_invites
 from datetime import datetime, timedelta, timezone
 from collections import defaultdict, deque
 import logging
@@ -1233,7 +1234,7 @@ async def update_profile_email(payload: dict, current_user: dict = Depends(get_c
     return {"status": "ok", "email": email}
 
 
-@router.get("/profile/invites")
+@router.get("/profile/invites", dependencies=[Depends(require_invites)])
 async def profile_invites(current_user: dict = Depends(get_current_user)) -> dict:
     username = str(current_user.get("username") or "").strip()
     if not username: