Batch invites only enforced seats deep inside create_account, per invitee
against a cached count, so a single batch could overshoot the cap. Count
seat-consuming invitees (emails with no existing account) upfront and
reject the whole batch before any account is created, mirroring the
workspace-members admission check. The per-invitee seats catch is folded
into the generic failure handler.