feat: start trials from platform admin invites

[alx-xo]

Linear: GRW-62

Summary

• Start the existing 14-day Enterprise trial when an organization's first user accepts an invitation sent by a current platform admin.
• Keep local membership, role, entitlements, trial lifecycle, audit operation, and invitation acceptance atomic while serializing concurrent acceptances.
• Refresh cached trial entitlements after commit and reconcile the accepted invitation role into WorkOS without making external failures roll back local acceptance.

Motivation

Organizations created and configured by platform admins previously missed the self-serve Enterprise trial lifecycle when their first customer joined. This reuses the established trial provisioning and lifecycle behavior while preserving whitelist settings, existing trial history, self-signup, and ordinary invitation behavior.

---

Summary by cubic

Starts the existing 14-day Enterprise trial when an organization's first user accepts an invite sent by a current platform admin. Organizations created by platform admins previously skipped the trial lifecycle; now the first customer to accept an invite gets the same self-serve Enterprise trial as signup.

• Makes membership, role assignment, entitlements, trial lifecycle, audit entry, and invitation acceptance atomic and serializes concurrent acceptances.
• Refreshes cached trial entitlements after commit.
• Reconciles the accepted invitation role into WorkOS without rolling back local acceptance when external calls fail, and preserves any existing WorkOS roles on the membership.

^{Written for commit 76c1e02. Summary will update on new commits.}

[linear-code]

GRW-62

[changeset-bot]

⚠️ No Changeset found

Latest commit: 76c1e02

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cubic-dev-ai]

Running ultrareview automatically — This PR reworks invitation acceptance to arm enterprise trials atomically with row locks, serialized concurrency, and external WorkOS reconciliation—any subtle bug could corrupt trial lifecycle, membership, or audit data, so a deep multi-pass review is warranted.. I'll post findings when complete.

[github-actions]

atlas migrate lint on server/migrations

Status	Step	Result
	No migration files detected
	ERD and visual diff generated	View Visualization
	No issues found	View Report
Read the full linting report on Atlas Cloud

[github-actions]

atlas migrate lint on server/clickhouse/migrations

Status	Step	Result
	No migration files detected
	ERD and visual diff generated	View Visualization
	No issues found	View Report
Read the full linting report on Atlas Cloud

[cubic-dev-ai]

Ultrareview completed in 9m 13s

All reported issues were addressed across 12 files

Linked issue analysis

Linked issue: GRW-62: feat: start enterprise trial when first platform-admin invite is accepted

Status	Acceptance criteria	Notes
✅	A first user accepting an organization invitation sent by a current platform admin starts an active 14-day Enterprise trial.	The acceptance transaction detects a platform-admin inviter and first-user condition, arms the Enterprise trial, and the integration test verifies tier and 14-day duration.
✅	The new membership, role assignments, entitlements, trial lifecycle, audit record, and invitation acceptance are atomic and concurrent first acceptances produce one trial.	Acceptance locks the organization, performs local provisioning and trial arming in one transaction, and tests verify rollback on bundle failure plus serialized concurrent acceptance.
✅	The invited first user retains the invitation's organization-admin role and role synchronization is preserved.	The invitation role is persisted and synchronized transactionally, then reconciled with WorkOS after commit; tests verify the authoritative role and existing-membership reconciliation.
✅	The organization's configured whitelist value and existing trial lifecycle remain unchanged where applicable.	Trial arming updates account type without changing whitelist state, and the tests verify whitelist preservation and no changes to an existing lifecycle.
✅	The successful first-user flow triggers the existing trial lifecycle messaging and PostHog onboarding event with created_via set to platform_admin_invite.	Post-commit TrialStarted and PostHog capture/identify calls are implemented, with failures logged without rolling back acceptance; the test verifies the event shape and notification behavior.
✅	Later invitations, ordinary organization invitations, existing trial records, and deleted/non-platform-admin inviters do not incorrectly start a new trial.	Eligibility requires no other active users, a non-deleted platform-admin inviter, and no existing lifecycle; dedicated tests cover ordinary invites, existing lifecycles, and deleted inviters.

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>