The signup form goes through signupAllowed, and a throttled form signup says when to try again #2363

Part of #2322. Both tries wired every door at once and went red in suites that sign up more than 5 users a minute from loopback (signup.per_source defaults to 5): test/web-origins.test.ts and test/origins-security-auth.test.ts.

Done looks like:

• [ ] The POST /signup form handler calls signupAllowed(ctx) (already on main in src/web/pages/site.ts). When it is throttled, it renders the signup page with "Too many sign-ups from here; try again in N seconds" and a 429. No other door changes.
• [ ] Every suite that signs up more than 5 users through the form raises signup.per_source in its own setup through the limits setting in src/settings/limits.ts, and changes no assertion. Find them with grep -l '/signup' test/*.ts.
• [ ] Test: a sixth form signup in a minute from one source gets the page with the wait.
• [ ] Run every file the grep names and quote the result.