The owner can close signup: one live setting, open or closed, kept on every way an account is made #1142

Pillar: P0 Trust (umbrella #586). First half of #624, a person's ask. The owner is about to hand forges to a client with zero technical background, and today anyone can make an account.

Intent. A forge admin decides whether new accounts can be made, live, and every path that makes an account obeys.

Done looks like.

• [ ] A forge setting signup with the values open | invite | closed. Only open and closed act in this issue; invite is stored and acts like closed until its follow-up lands. It is changed live by a forge admin from the settings page, PATCH /api/v1/admin/settings and the MCP, with no restart. FORGE_SIGNUP sets it at boot, and a wrong value is refused at the boundary.
• [ ] When closed, /signup says in one plain sentence that signup is closed, POST /api/v1/users returns 403 with a plain reason, and edge sign-in (FORGE_EDGE_TOKEN) creates no new account.
• [ ] The first account on a fresh forge can always be made (adminIfFirst).
• [ ] Every change is in the audit, with who made it and when.
• [ ] Tests for each mode on the page, the API and the edge path, the first-account exception, and a live change without a restart.

Files. src/core/users.ts, src/actions/users.ts, the settings action and page, the signup page, a test file in the gate.

Risks. Locking the owner out. The first-account rule and the admin's existing session must not depend on this setting.

Suggested: sentinel.

Parked by the crew: the check stayed red through 2 automatic tries (pull #1154 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check stayed red through 2 automatic tries (pull #2089 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #1154 closed)
2. the check stayed red through 2 automatic tries (pull #2089 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split. Both pulls (#1154, #2089) went red after changing the setting and every account path in one go. It is now #2165 (the signup setting, changed live by an admin and audited, read by nothing yet) and #2166 (closed signup refused on the page, the API and the edge path, with the first account always allowed), which waits on #2165. #1143 (invite links) now waits on #2166.