A forge setting `signup` (open, invite or closed) that an admin changes live, kept in the audit #2165

Split from #1142 (a person's ask, part of #624). Two pulls on it went red because they changed every account path at once. This part only adds the setting. Nothing reads it yet.

Done looks like:

• [ ] A forge setting signup with the values open | invite | closed, default open. It lives beside the other forge settings (follow how src/settings/quotas.ts is shaped).
• [ ] A forge admin changes it live from the admin settings page, PATCH /api/v1/admin/settings ({"signup":"closed"}) and the settings MCP tool, with no restart. Any other value is a 422 at the boundary.
• [ ] FORGE_SIGNUP sets it at boot. A wrong value stops the boot with a plain message.
• [ ] Every change is recorded with who made it and when, and listed beside the form.
• [ ] Tests: each door sets it, a bad value is refused, a non-admin gets 403, and the audit row is written. A new migration, if needed, is a timestamp-named file under src/core/migrations/.
• [ ] README: one paragraph next to the quotas paragraph.

Risk: keep the change small. Touch no sign-in or signup path in this issue. Brief: sentinel.