fix: hide raw SQL error on consumed invite, fix already-collaborator redirect URL

internal/handler/handler.go

···
 
 	invite, err := collaboration.ValidateInvite(h.DB, inviteToken, rKey)
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		log.Printf("AcceptInvite: validate invite rkey=%s: %v", rKey, err)
+		http.Error(w, "Invite not found, already used, or expired.", http.StatusBadRequest)
 		return
 	}
 
···
 		return
 	}
 
-	// Already a collaborator — just redirect.
+	// Already a collaborator — redirect to the owner-scoped URL.
 	for _, c := range doc.Collaborators {
 		if c == collabSession.DID {
-			http.Redirect(w, r, "/docs/"+rKey, http.StatusSeeOther)
+			http.Redirect(w, r, "/docs/"+invite.CreatedBy+"/"+rKey, http.StatusSeeOther)
 			return
 		}
 	}