fix(rsvp): defend the edit flow against forwarded invitation links

When a guest submitted via their invitation and then forwarded the link
(or someone copied the URL), the recipient was shown the original guest's
response and a "Change my response" button. Two real problems:
  - Privacy leak: the original guest's reply was visible
  - Integrity: the recipient could silently overwrite the response

The fix is two layered defences plus a recovery path, matching the
industry pattern used by Eventbrite / Partiful / Lu.ma:

Backend
  - GET /access/{token} now compares the device fingerprint of the
    current request to the fingerprint stored on the existing RSVP.
    When they don't match, the rsvp field is omitted from the
    response and a new rsvp_submitted_elsewhere flag is set instead.
    The original guest's reply stays private.
  - PATCH /rsvp/{token} runs the same gate before scoring. A foreign
    device gets 403 with a hint to request an edit link.
  - The fingerprint check is intentionally narrow (user_agent only),
    so a guest jumping between Wi-Fi and mobile data on the same
    phone still sails through.

Recovery path
  - New POST /access/{token}/request-edit-link mints a short-lived
    edit nonce (Redis, 30-min TTL, SHA-256-hashed), then emails it
    to the guest's address on file via the existing EmailSender.
    Rate-limited to 3 per token per hour.
  - GET /access/{token}?edit=<nonce> and PATCH /rsvp with edit_nonce
    in the body both accept the nonce as a bypass for the
    same-device check. Lets the real guest edit from a new phone
    when their original device is gone.
  - New SendRSVPEditLink method on auth.EmailSender, implemented by
    every concrete sender (log stub / Resend / SMTP / SES), with a
    branded HTML+text template that explains the "we sent this
    because we didn't recognise the device" framing.

Frontend
  - rsvp/[token].vue learns the new "responded elsewhere" state.
    Renders "This invitation has already been used" + a
    "Send me an edit link" CTA when the access response says we
    have somewhere to deliver it. Empty-state copy reads "If you
    forwarded the link, please ask the original guest to reach
    out to the host".
  - When the URL carries ?edit=<nonce>, the page passes it on the
    /access call (so the backend unhides the RSVP), opens the edit
    form pre-populated, and forwards the nonce on PATCH.
  - Removed two leftover leaks from earlier — the page no longer
    shows internal "Risk score N · band" to confirmed or blocked
    guests; the blocked-attempt copy now reads "Something about
    this attempt looked off" rather than "suspicious access
    attempt".

Defensive nil-guard
  - The access handler's NATS publish goroutine now skips when
    deps.AccessPublisher is nil (matches the rsvp publisher's
    existing guard); without it the handler nil-panicked in tests
    that don't wire NATS.

Tests
  - TestFingerprintsSimilar (unit) covers the same-UA / different-UA
    / missing-UA matrix.
  - TestForwardedInvitationLinkDefence (integration) walks the full
    flow: submit from UA-A, hide on UA-B, request link, follow nonce
    from UA-B and edit, then verify a UA-C with a forged nonce is
    still refused.
  - Full integration suite passes (183.5s).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/api/rsvps.go

@@ -34,6 +34,7 @@ type rsvpHandler struct {
 	rsvps      *storage.RSVPRepo
 	accessLogs *storage.AccessLogRepo
 	allowlist  *storage.AllowlistRepo
+	editNonces *editNonceStore
 	scorer     fraudScorer
 	pub        rsvpPublisher
 }
@@ -43,6 +44,12 @@ type submitRSVPRequest struct {
 	PlusOnes     int            `json:"plus_ones"`
 	DietaryNotes *string        `json:"dietary_notes"`
 	Fingerprint  map[string]any `json:"fingerprint"`
+	// EditNonce is the short-lived value carried back from the magic
+	// edit link the guest received by email. It bypasses the
+	// same-device check on PATCH so a guest who jumped to a new phone
+	// can still edit their RSVP. Empty on POST and on edits from the
+	// original device.
+	EditNonce string `json:"edit_nonce,omitempty"`
 }
 
 type submitRSVPResponse struct {
@@ -117,6 +124,13 @@ func (h *rsvpHandler) submit(w http.ResponseWriter, r *http.Request) {
 // PATCH /rsvp/{token} — revise an existing RSVP. Same fraud check as POST.
 // The prior state is snapshotted into rsvp_revisions inside Update; edits
 // past MaxRSVPEdits return 429.
+//
+// As of the forwarded-link defence: a PATCH is only accepted when either
+// (a) the current device fingerprint matches the one stored on the
+// existing RSVP, or (b) the caller presented a valid edit nonce in the
+// request body. Otherwise we refuse with 403 + a hint to request an edit
+// link — this stops anyone the original guest forwarded the link to from
+// quietly altering the response.
 func (h *rsvpHandler) edit(w http.ResponseWriter, r *http.Request) {
 	tk, ok := h.loadValidToken(w, r)
 	if !ok {
@@ -136,6 +150,28 @@ func (h *rsvpHandler) edit(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Forwarded-link gate. Load the existing RSVP (if any) so we can
+	// compare device fingerprints; absent RSVP means this is a quirky
+	// PATCH-before-POST flow that Update will 404 below anyway.
+	if existing, err := h.rsvps.GetByGuest(r.Context(), guest.ID); err == nil && existing != nil {
+		current := mergeFingerprint(req.Fingerprint, collectFingerprint(r))
+		if !fingerprintsSimilar(existing.DeviceFingerprint, current) {
+			// Bypass via edit nonce delivered to the guest's email.
+			bypassed := false
+			if h.editNonces != nil && req.EditNonce != "" {
+				if ok, _ := h.editNonces.Verify(r.Context(), req.EditNonce, guest.ID); ok {
+					bypassed = true
+				}
+			}
+			if !bypassed {
+				writeError(w, http.StatusForbidden,
+					"this invitation looks like it's being opened from a different device; "+
+						"please request an edit link from the previous screen")
+				return
+			}
+		}
+	}
+
 	decision, fingerprint, ip, ok := h.scoreAccess(w, r, event, guest, tk, req.Fingerprint)
 	if !ok {
 		return
@@ -238,6 +274,7 @@ type decodedRSVPRequest struct {
 	PlusOnes     int
 	DietaryNotes *string
 	Fingerprint  map[string]any
+	EditNonce    string
 }
 
 func decodeSubmitRSVP(w http.ResponseWriter, r *http.Request) (decodedRSVPRequest, bool) {
@@ -260,6 +297,7 @@ func decodeSubmitRSVP(w http.ResponseWriter, r *http.Request) (decodedRSVPReques
 		PlusOnes:     req.PlusOnes,
 		DietaryNotes: req.DietaryNotes,
 		Fingerprint:  req.Fingerprint,
+		EditNonce:    req.EditNonce,
 	}, true
 }