Add admin page to set maximum number of invites per fallback proxy.

Also remove remnants of the old per-user invite limits.
Remove remnants of installer bucket scheme.
Long overdue renaming: InvitedServer -> FallbackProxy.
IGNORE: Cosmetic and whitespace fixes.

I factored these out of a bigger commit to remove noise from it.
Replace the logic for launching fallback proxies.

We launch a new fallback proxy whenever a user who is their own
fallbackProxyUserId first invites someone, or whenever we have
sent `maxInvitesPerFallback` (configurable in the admin interface)
invites with installer links pointing to that proxy.

As of this writing, we are expected to empirically fine tune that
value by correlating the observed load of running instances to the
number of invites recorded for it.  In the future we will automate
that.

I couldn't find a good way to further split the commit.  This
probably hints at this implementation being badly factored.  I'll
think of ways to untangle and simplify the logic after having
tested and documented how things work now.