Activate regular user account

Activate invited user account and set password (public endpoint, API key only). Requires invitation token, password policy compliance, and terms/privacy acceptance. Activation runs in a transaction (user activation, password, metadata merge, RBAC grants); on invariant failure (e.g. missing email credential row after validation) the server responds 422 with users_m.email_credential_not_found.

curl -X POST "https://example.com/v1/users/activate" \  -H "Content-Type: application/json" \  -d '{    "token": "string",    "password": "stringstring",    "terms_accepted": true,    "privacy_policy_accepted": true  }'

{
  "message": "string",
  "redirect_url": "http://example.com"
}

{
  "code": "users_m.invalid_user_input",
  "message": "Invalid user input data"
}

{
  "code": "users_m.user_already_exists",
  "message": "User with this email already exists"
}

{
  "code": "users_m.email_credential_not_found",
  "message": "Email credential not found for this user"
}