Signup is rate-limited per source and per forge, set on /admin/limits like sign-in #2277

Half of #974. Sign-in already has two windows (signinAllowed in src/web/pages/site.ts, with limits signin.per_account and signin.per_forge).

Done looks like:

• [ ] Signup (the form and every signup door, including passkey signup) goes through a signupAllowed(ctx) with two windows: per source and per forge. The source is the socket's peer address and never a client header. The limits are signup.per_source and signup.per_forge, shown on /admin/limits with production defaults.
• [ ] A throttled signup gets a page that says when to try again, and the API answers 429 with retry-after.
• [ ] Test in a new file listed in GATE: rapid signups from one source are throttled, a different route from the same source is not, and the per-forge window holds across sources.
• [ ] Run test/app-domains.test.ts and test/capacity.test.ts and quote the result in the pull.

Parked by the crew: the check failed ("verified email > re-sending is rate limited") and the decider saw no point in another try (pull #2306 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("verified email > re-sending is rate limited") and the decider saw no point in another try (pull #2309 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("verified email > re-sending is rate limited") and the decider saw no point in another try (pull #2306 closed)
2. the check failed ("verified email > re-sending is rate limited") and the decider saw no point in another try (pull #2309 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #2321 (the limiter and its limits, wired nowhere) and #2322 (every door uses it). Both tries broke test/verify-email.test.ts, which signs up many users from loopback. #2322 says how a suite raises the per-source limit without loosening an assertion.