#1018 User-welcome and invitation emails interpolate unescaped values into HTML

EARS: When the API builds an HTML email body, every interpolated value shall be HTML-escaped. Found during #1010 sweep: api/blueprints/v1/users_helpers.py _send_user_welcome_email formats tenant_name, admin_name, roles_display, email, base_url raw into USER_WELCOME_EMAIL_TEMPLATE; api/utils/invitation_email.py formats inviter_name, tenant_display_name, roles_display, message (caller-supplied invitation text) and invitation_url raw. api/blueprints/v1/invitations_helpers.py already escapes (pattern to copy). Not fixed in #1010 (emails, not routes; invitation_email.py is being edited by another agent).