D2 front door: reject internal-domain invites

Shared, configurable domain list

• New src/lib/team-invitations/internal-domains.ts is the single source of truth: internalEmailDomains() and isInternalEmailDomain(email).
• Configurable via NEXT_PUBLIC_PRAMAAN_INTERNAL_EMAIL_DOMAINS (comma-separated), default pramaan.io. Nothing is hard-coded inline at the call sites.
• The NEXT_PUBLIC_ prefix is deliberate: the same list resolves on the client (form validation) and on the server (the Clerk-issuing action). Parsing is trimmed, lowercased, and blank-safe.

Front-door enforcement (two layers)

• Client / form. teamInvitationCreateRequestSchema gains an email .refine that flags internal domains with a machine-readable marker (INTERNAL_DOMAIN_ISSUE). Because this schema also backs the /api/internal/team-invitations route's safeParse, the API boundary rejects internal domains too.
• Server action. createTeamInvitation throws a TeamInvitationAccessError (422, pramaan.team_invitations.internal_domain_blocked) before calling clerkClient().organizations.createOrganizationInvitation — the definitive front door.

Clear inline message, localized

• invite-member-fields.tsx maps the marker to a distinct inline error (Team.invite.emailInternalDomainError) with the configured domain interpolated, separate from the generic "enter a valid email" copy.
• use-team-list-actions.ts maps the server error code to a form-level message (Team.invite.internalDomainBlocked) for any path that bypasses the form (e.g. client/server config divergence).
• Both new keys exist in messages/en.json and messages/hi.json.

Acceptance criteria

• Inviting someone@pramaan.io is rejected client-side with a clear message; no Clerk org invitation is created. met
• Domain list is env/shared-config driven, default pramaan.io, not hard-coded. met
• Non-internal-domain invites work unchanged. met
• Cites pramaan-docs ADR-123; references Story-1347.

Verification

• pnpm lint passed (only pre-existing add-matter warnings).
• pnpm test 528 passed, including the new internal-domains.test.ts and the server-guard case in server.test.ts.
• pnpm build passed.
• git diff --check clean.

Files changed

9 file(s), +168 / -3 lines