Super-admin escalation via scope-blind invitation checks

Privilege escalation in Grav Plugin API before 1.0.13 allows remote authenticated users to create fully controlled super accounts. InvitationsController::create() uses a bare isSuperAdmin() result instead of scope-aware authorization, preserving submitted super-access flags and groups; accept() then writes them verbatim to the new account. Exploitation requires an api.users.write key minted for a super account and creates a persistent privileged account controlled by the key holder.