A throttled source can still use the rest of the forge: past the signup and sign-in limits, its other requests answer as before #2469

Replaces #974 (a person's ask). Every door #974 named is now limited: signupAllowed (per source, per forge; #2327, #2368, #2371, #2366, #2398) and signinAllowed with its per-source window (#2439). One promise in #974 has no test yet: no other route is caught.

Done looks like:

• [ ] A new test file, listed in GATE, uses a low signup.per_source and signin.per_source set in its setup. It throttles one loopback source on POST /signup and on sign-in (429 with retry-after on the API, the wait on the page).
• [ ] From that same source, while it is throttled, GET /, a repository page and a GET /api/v1/... read (signed in with an existing session) answer as they do unthrottled, not with 429.
• [ ] A sign-in with an existing session cookie is not refused by the signup window.
• [ ] No change to src/ unless the test finds a route that is caught. If it finds one, the fix is limited to removing that route from the limit.
• [ ] bun x tsc --noEmit and the new file pass. Quote both in the pull.

Files: test/throttle-scope.test.ts (new), scripts/gate.ts. Risk: other suites sign up more than five users a minute from loopback. Raise the limit only in this file's setup.