[ ] API signup calls signupAllowed(ctx). When it is throttled, it answers 429 with retry-after and a JSON error. No other door changes.
[ ] Suites that make more than 5 users through the API raise signup.per_source in their setup and change no assertion. Find them with grep -l 'api/v1/users' test/*.ts.
[ ] Test: the form and the API share one per-source window, so a form signup followed by API signups is throttled at the limit.
[ ] Run every file the grep names and quote the result.
Part of #2322.
Done looks like:
signupAllowed(ctx). When it is throttled, it answers 429 withretry-afterand a JSON error. No other door changes.signup.per_sourcein their setup and change no assertion. Find them withgrep -l 'api/v1/users' test/*.ts.