Correct workspace shown on invitation bell, and safer invite links

When you receive a share invitation, the notification bell now shows your own workspace context rather than the sender's app workspace, so multi-workspace users see the right label. Invite and share URLs are also hardened against Host-header spoofing that could otherwise embed an attacker's origin in a link.