Every signup door goes through signupAllowed and a throttled signup says when to try again #2322

Second half of #2277.

Done looks like:

• [ ] The signup form, the API signup and passkey signup (src/web/pages/signup-passkey.ts, which today borrows signinAllowed) call signupAllowed(ctx). A throttled page says when to try again. The API answers 429 with retry-after.
• [ ] Existing suites stay green without loosening their assertions. test/verify-email.test.ts ("re-sending is rate limited") signs up many users from loopback and broke both earlier tries. A suite that signs up more than the default per-source limit raises signup.per_source in its own setup, through the limits table, and changes no assertion.
• [ ] Test: signups through the form and through the API share one per-source window.
• [ ] Before pushing, run every test file that signs people up: grep -l signup test/*.ts. Quote the result in the pull.

Parked by the crew: the check failed ("origins on the web > (unnamed)") and the decider saw no point in another try (pull #2357 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("OAuth code flow: state, PKCE, redirects, and the callback URI > a callback carrying error=access_denied burns the state and creates nothing") and the decider saw no point in another try (pull #2358 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("origins on the web > (unnamed)") and the decider saw no point in another try (pull #2357 closed)
2. the check failed ("OAuth code flow: state, PKCE, redirects, and the callback URI > a callback carrying error=access_denied burns the state and creates nothing") and the decider saw no point in another try (pull #2358 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #2363 (the form), #2364 (the API) and #2365 (passkey and OAuth signup). Both tries wired every door at once. They went red in test/web-origins.test.ts and in the OAuth code-flow suite, which sign up more than signup.per_source's default of 5 users a minute from loopback. Each new issue changes one door and names the suites to run for it.