security(pds): enable invite requirement after spam attack

Deleted 41 spam bot accounts that were created between Dec 26-28.
All accounts used rotating residential proxies and followed the same
pattern: Brazilian-style names, no profiles, only follows/likes/reposts.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>