signupAllowed(ctx) holds two windows, per source and per forge, with signup.per_source and signup.per_forge on /admin/limits #2321

First half of #2277, which failed twice because existing suites sign up many accounts from one loopback source.

Done looks like:

• [ ] signupAllowed(ctx) beside signinAllowed in src/web/pages/site.ts returns the wait in seconds or undefined. It uses two windows: per source (the socket's peer address, never a client header) and per forge.
• [ ] The limits signup.per_source and signup.per_forge are listed on /admin/limits with production defaults, the same way the signin.* limits are.
• [ ] It is not wired into any signup door yet. No existing test changes.
• [ ] Unit test in a new file listed in GATE: rapid calls from one source are throttled, another source is not, and the per-forge window holds across sources.
• [ ] Run test/verify-email.test.ts and test/capacity.test.ts and quote the result in the pull.