fix: preserve invitations for admins with a family

tests/security.test.cjs

@@ -315,6 +315,33 @@ test('changing a parent email revokes sessions and requires fresh mailbox activa
   assert.equal((await accept({ attempt: 0 }, form(renewedInvite))).errors,undefined);
   assert.ok((await prisma.user.findUnique({ where: { id: parentA.id } })).emailVerifiedAt);
 });
+test('family admins keep their role when a changed mailbox is invited and activated', async () => {
+  const family = await prisma.family.create({ data: { kitaId: kitaA.id, name: 'Admin family' } });
+  const child = await prisma.child.create({ data: { kitaId: kitaA.id, familyId: family.id, firstName: 'Admin', lastName: 'Child' } });
+  const user = await prisma.user.create({ data: { email: `family-admin.${prefix}@example.invalid`, firstName: 'Family', lastName: 'Admin',
+    role: 'ADMIN', kitaId: kitaA.id, familyId: family.id, passwordHash: passHash,
+    emailVerifiedAt: new Date(), privacyPolicyAcceptedAt: new Date() } });
+  try {
+    const load = loader({ '@/auth': { auth: async () => session(adminA), signIn: async () => {} }, '@/lib/mail': emailMock });
+    const actions = load('src/app/dashboard/families/actions.ts');
+    const updated = await actions.updateFamilyAction({ familyId: family.id, familyName: 'Family A',
+      parents: [{ id: user.id, firstName: 'Family', lastName: 'Admin', email: `changed-family-admin.${prefix}@example.invalid` }],
+      children: [{ id: child.id, firstName: 'A', lastName: 'Test' }] });
+    assert.equal(updated.success,true,updated.error); assert.equal(updated.warning,undefined);
+    assert.equal((await prisma.user.findUnique({ where: { id: user.id } })).role,'ADMIN');
+    await prisma.invitation.update({ where: { userId: user.id }, data: { sentAt: new Date(Date.now() - 61_000) } });
+    assert.equal((await actions.resendParentInvite(user.id)).success,true);
+    const token = emails.at(-1).react.props.inviteLink.split('/').at(-1);
+    const accepted = await load('src/app/invite/[token]/actions.ts').acceptInviteAction({ attempt: 0 }, fields({ token,
+      password: 'Family-admin-new-password', confirmPassword: 'Family-admin-new-password', acceptPrivacyPolicy: 'on' }));
+    assert.equal(accepted.errors,undefined);
+    const activated = await prisma.user.findUnique({ where: { id: user.id } });
+    assert.equal(activated.role,'ADMIN'); assert.ok(activated.emailVerifiedAt);
+  } finally {
+    await prisma.verificationToken.deleteMany({ where: { identifier: user.id } });
+    await prisma.family.delete({ where: { id: family.id } });
+  }
+});
 test('resending an invite cannot issue an active link to an obsolete mailbox', async () => {
   const user = await prisma.user.create({ data: { email: `resend-race.${prefix}@example.invalid`, firstName: 'Race', lastName: 'Test',
     role: 'ELTERN', kitaId: kitaA.id, familyId: familyA.id, passwordHash: '' } });