fix: Cloudron enrollment + 2FA for fresh invite accounts

Invite acceptance (verified live on 8 agents): Pankow forms need
click + keyboard.type (fill() silently no-ops), submit button is
<div role="button"> "Set up" which starts disabled until the form
is valid.

2FA enablement: fresh accounts land on setupaccount.html ("Your
account is ready") and hash navigation cannot leave that page --
load the panel root first. Also match "Set up" (forced-enrollment
screen says "Set up passkey", profile page says "Setup").

Verified in the 8-agent run: coo/svp-knel/svp-tctc/vp-investing/
vp-trading/vp-compliance enrolled with TOTP. vp-secops and
vp-techcompliance ran pre-fix and need the --enable-2fa second pass.

docker-compose.yml

@@ -22,3 +22,4 @@ services:
       - ./provision-discourse-apikey.py:/app/provision-discourse-apikey.py:ro
       - ./provision-redmine.py:/app/provision-redmine.py:ro
       - ./merge-invites.py:/app/merge-invites.py:ro
+      - ./dump-invite-page.py:/app/dump-invite-page.py:ro