Currently, users must have a Phacility account in order to be added to an instance. This is probably unreasonably burdensome in most realistic situations.

Presumably, we should have an "invite by email" flow instead. I started to build this, but it got really messy when we hit this case:

• You invite a@b.com.
• That address is already associated with an account as the primary address, but is not verified.
• The user who follows the link is logged in to a separate account.

I think we have to either roadblock them or steal the primary address, and both options suck, although roadblocking is probably less bad (whether the second account was registered maliciously, incorrectly, or just accidentally, they can password-recover it to gain control of it, then do whatever they want with it).

I think this is navigable, the workflow just ended up being very complicated.

The invite also likely needs to be mostly handled by the upstream, and then hooked into by Instances at the end to actually add the account as a member. This makes it more complex.