A fresh forge's first account follows the signup setting and the Turnstile check like any other, now that no sign-up makes the admin. #59

The closed/invite exemption for a forge with no accounts and the terminal's Turnstile skip for that account existed so the owner could become the admin. Since #57 the admin comes only from the operator's first-admin link, a claim or seed, so both only let in an unverified non-admin. newAccountsClosed now reads the setting alone; signUp drops its door option; the terminal's sign-in screen opens on Sign in when signup is closed.

Regression tests

Each of these fails on main 39c8c722 and passes here (same test files run against main's src: 5 fail / 55 pass; on this branch 60 / 60):

• signup.test.ts: a fresh forge's first account is refused while closed (API 403), and its first edge sign-in too (401).
• signup-closed.test.ts: the same through the edge and API, on a forge with no accounts.
• tui-screens.test.ts: with signup closed, a fresh forge's terminal offers no Create account and makes none.
• turnstile.test.ts: with Turnstile on, the terminal is asked for the first account too and makes none.

Tests that stated the old rule now state the new one. The operator's first-admin link, the claim handover and seed don't consult the signup setting or Turnstile, so they're unchanged: first-admin, claim and spawn suites pass.

<!-- pipeline:validation -->

Validation

pipeline/validate on f86f09e8: baseline in 570s — bun 1.3.14, CI-shaped env (scrubbed vars, runner PATH), exact check.yml shard + forge.json commands.

• ⚠️ node v20.19.2 here, v22 on CI (tsc runs under node)
• ⚠️ check.yml gate (1) pull_request stopped early at a BASELINE failure (fail-fast): its later files were not run in this step

▶ bun install --frozen-lockfile
  ok  exit 0  0s
▶ forge.json check.fast
(fail) reviews, threads and the merge gate > require-review refuses the merge until the head is approved [309.70ms] [shard 9]
(fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [1.09ms] [shard 10]
Ran 3539 tests across 354 files in 103.2s; 2 failed.
classify: reran test/contain.test.ts test/fork-pull-approval.test.ts test/tui-workflows.test.ts test/variants-deck.test.ts  alone on origin/main 39c8c722 and on this branch
  BASELINE  exit 1  114s
▶ check.yml gate (1) pull_request
(fail) egress, reported: an undeclared public host goes through and is counted; a private one never does > an undeclared public host is let through and counted [1.55ms] [shard 3]
Ran 110 tests across 3 files in 14.2s; 1 failed.
classify: reran test/contain.test.ts  alone on origin/main 39c8c722 and on this branch
  BASELINE  exit 1  14s
▶ check.yml gate (2) pull_request
Ran 1455 tests across 144 files in 261.1s (144 shards).
  ok  exit 0  262s
▶ check.yml gate (3) pull_request
Ran 1542 tests across 145 files in 180.7s (145 shards).
  ok  exit 0  180s