The signup page renders the Turnstile widget when a site key is set, with CSP widened on /signup only, and the admin settings and README say how to turn it on #1666

Replaces the rest of #1457.

Done looks like:

• [ ] With a site key set, /signup renders the widget and sends its token with the form; only that response's Content-Security-Policy admits https://challenges.cloudflare.com; every other page's CSP is unchanged (a test asserts both). The secret never reaches any page.
• [ ] With no key, the admin settings say "Signup has no human check" in one line; the README says which two variables turn it on.
• [ ] Tests named in GATE in the same commit; run tsc and them before pushing.