Encode sign-in mail as base64 so webmail cannot mangle the verify token.

Quoted-printable still rewrote token= as token=3D in the raw MIME, which some clients never decode. Distinguish a missing token from a real expiry, and keep links valid for 60 minutes.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/server/ruleStakeholders.ts

@@ -1,2 +1,2 @@
-/** Parity with magic-link request TTL (15 minutes). */
-export const STAKEHOLDER_INVITE_TTL_MS = 15 * 60 * 1000;
+/** Parity with magic-link request TTL (60 minutes). */
+export const STAKEHOLDER_INVITE_TTL_MS = 60 * 60 * 1000;