A test pins MCP `signup`: reading the mode is free, changing it plans first and needs an admin token, an unknown mode is refused #7147

src/http/mcp/tools/signup.ts refuses invalid_signup, and no test names it. Each case calls the tool through /mcp with a real token, as test/mcp.test.ts does.

Done:

• [ ] A new test: with no mode, an admin reads the current mode.
• [ ] { mode: "closed" } plans (dryRun defaults true) and changes nothing. { mode: "closed", dryRun: false } with an admin-scope token applies it, and a new sign-up is then refused.
• [ ] mode: "public" is invalid_signup. Applying with an rw token, or as a non-admin, is refused, and the mode is unchanged.

Files: test/mcp-signup.test.ts

If the test finds the behaviour wrong, fix the tool in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.