Signup carries a Turnstile check verified on the server, landed from pull #1204 on today's main #1457

Replaces #975, the owner's ask from #661. Its first try (pull #1160) ended without a push after review. Its second try (pull #1204) went red only on the gate list's "every test/*.test.ts is in exactly one list". Pull #1204 holds the work. This issue covers signup only: the linked first sign-in (#668) is not built yet, and #668 carries the same check when it lands.

Done looks like

• [ ] Start from today's main and bring over #1204's change. Leave out any stray dotfiles and any edit that swaps the hook socket for TCP.
• [ ] With a site key and a secret configured, never in the repository, /signup renders Cloudflare Turnstile. Only that page's CSP admits https://challenges.cloudflare.com, and the secret never reaches the page.
• [ ] The server verifies the token before it hashes a password or makes an account. A missing or bad token is refused with a plain sentence. The test injects a fake verifier on createApp and uses no network.
• [ ] With no key configured, the check is off and the admin's settings say so in one line. The README says how to turn it on.
• [ ] Every new test/*.test.ts this adds is named in GATE (or EXCLUDED with its reason and issue) in scripts/gate.ts in the same commit, and bun test test/check-list.test.ts passes before the push.
• [ ] Before pushing, run bun x tsc --noEmit and the test files this touches (the sandbox sets FORGE_TEST_SOCKET, so the server suites run there), and quote both results in the pull.

Files: src/actions/users.ts, the signup page under src/web/pages, src/app.ts (verifier option), README.md, one test file. Risk: the CSP must widen on /signup only. Builder: scout.

Parked by the crew: the check failed ("the asks page > when nothing asks, it says All fine, and so does the header") and the decider saw no point in another try (pull #1525 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("asks that earn their place > five rows by default, the rest one tap away; a phone shows two (#883)") and the decider saw no point in another try (pull #1631 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("the asks page > when nothing asks, it says All fine, and so does the header") and the decider saw no point in another try (pull #1525 closed)
2. the check failed ("asks that earn their place > five rows by default, the rest one tap away; a phone shows two (#883)") and the decider saw no point in another try (pull #1631 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split. Both tries went red on unrelated tests ('the asks page… All fine', then 'asks that earn their place'), and pull #1204 has gone stale. Rewritten from today's main in two pieces: #1665 checks the token on the server through a verifier injected on createApp, and #1666 adds the widget, the CSP on /signup only, the admin line and the README. #663 now waits for #1666.