Activate regular user account

AUTHENTICATED BY X-API-Key, not by a bearer token. auth.APIKeyMiddleware REPLACES the usual chain on this route, so there is no user context, no RBAC check and no licence check — and the refusals are common.api_key_required / common.invalid_api_key rather than common.unauthorized / common.rbac_no_rec_access. An OPTIONS request skips the key check entirely. Activate invited user account and set password (public endpoint, API key only). Requires invitation token, password policy compliance, and terms/privacy acceptance. Activation runs in a transaction (user activation, password, metadata merge, RBAC grants); on invariant failure (e.g. missing email credential row after validation) the server responds 422 with users_m.email_credential_not_found.

curl -X POST "https://example.com/v1/users/activate" \  -H "Content-Type: application/json" \  -d '{    "token": "string",    "password": "stringstring",    "terms_accepted": true,    "privacy_policy_accepted": true  }'

{
  "message": "string",
  "redirect_url": "http://example.com"
}

{
  "status": 400,
  "message": "Invalid user input",
  "code": "users_m.invalid_user_input",
  "class": "validation"
}

{
  "status": 401,
  "message": "common.api_key_required",
  "code": "common.api_key_required",
  "class": "business"
}

{
  "status": 403,
  "message": "common.invalid_api_key",
  "code": "common.invalid_api_key",
  "class": "business"
}

{
  "status": 409,
  "message": "Credential already exists",
  "code": "users_m.duplicate_credential",
  "class": "business"
}

{
  "status": 422,
  "message": "No email credential found for this user",
  "code": "users_m.email_credential_not_found",
  "class": "validation"
}

{
  "status": 429,
  "message": "Too many activation attempts. Please try again in 842 seconds",
  "code": "users_m.activation_rate_limit_exceeded",
  "class": "temporary",
  "retryable": true
}

{
  "status": 500,
  "message": "Internal server error",
  "code": "common.server_error",
  "class": "business"
}

{
  "overall_status": "unhealthy",
  "message": "Service is shutting down",
  "timestamp": "2026-08-27T15:04:05Z"
}