Create an account for new exhibitors and send them a set-password link #301

Problem

When an organizer creates an exhibitor profile, the invitation email asks the exhibitor to sign up with the profile's email address, confirm that address, and then open My Exhibitions. An exhibitor with no account has to work this out alone, and one who skips the confirmation gets a "not found" page.

Talks handles the same situation differently. When an organizer adds a speaker, the speaker gets an email with a link that works. If they have no account, one is created for them and the email contains a link to set a password.

Expected behavior

When an organizer creates a profile with an email address:

• Existing account: if an account with that email exists (case-insensitive), the profile is matched to it. The invitation links to the exhibitor's My Exhibitions page, and they log in as usual.
• No account:
  • An account is created for that email.
  • The invitation contains a link to set a password, like the new-account speaker invite in Talks.
  • After setting a password, the exhibitor lands in My Exhibitions.
• Verified email: following the set-password link marks that email as verified, because the link proves they control the address. The profile appears in My Exhibitions straight away and does not need a second confirmation.
• No email address: no account is created and no invitation is queued.

Email templates

Two default templates, mirroring Talks:

• New account: says a profile has been created, that an account has been created for them, and gives the link to set a password.
• Existing account: says a profile has been created and links to My Exhibitions.

Both:

• Use the same subject, "You have been added as an exhibitor for {event_name}", and the same organisers sign-off.
• Are editable per event on the exhibition email templates page.
• Use these placeholders: {exhibitor_name}, {event_name}, {my_exhibitions_url} and {login_email}, plus {invitation_link} in the new-account template only.
• Are queued in the outbox for the organizer to send, like the other exhibition emails.

Security

• The set-password link is single-use and expires after a limited time, as in Talks.
• Verification is granted only through that link. Creating an account elsewhere with the same email still has to be confirmed before it can open the profile.
• Request-based profiles are unchanged and stay with the requesting account.

Acceptance criteria

• Creating a profile for an email with no account creates an account and queues the new-account email containing a working set-password link.
• Creating a profile for an email that already has an account creates no account and queues the existing-account email.
• Following the link sets the password, marks the email verified, and shows the profile in My Exhibitions.
• Matching an existing account ignores case and does not create a duplicate.
• Creating a profile with no email creates no account and queues nothing.
• An expired or reused link does not log anyone in or verify the email.
• Both templates can be edited per event, and their placeholders are listed in the template editor.
• Tests cover both cases, verification through the link, and the no-email case.

Dependencies. #291