Signup and sign-in are rate-limited per source and globally, configurable on createApp, and no other request is caught #974

Pillar: P0 Trust (#586). Half of #661 (trevato's ask). Pull #891's per-source limit in src/http/doors.ts is the start. Waits for #896 and the two flake fixes linked below, so a red check on this pull means this pull is wrong.

Done looks like

• [ ] Signup, sign-in, and a first sign-in through any linked method (#668) are limited per source and globally, keyed on the socket or the identity and never on a client header. A throttled request gets a clear retry message on the page and a 429 with retry-after on the API.
• [ ] The limits are options on createApp with production defaults. Tests that sign in many times set them on purpose. No other route is limited.
• [ ] Test (in GATE): rapid signups and sign-ins from one source are throttled, another route from the same source is not, and the global limit holds across sources.
• [ ] test/app-domains.test.ts and test/capacity.test.ts pass on the branch. Quote them.
• [ ] Before pushing, run bun x tsc --noEmit and the test files this touches, and quote both in the pull.

🤖 Generated with Claude Code

Split into #2277 (signup: per-source and per-forge windows on /admin/limits) and #2278 (sign-in gets a per-source window beside its existing per-account and per-forge ones). Sign-in was already limited on main, so the fresh issues extend the limitValue pattern in site.ts rather than adding options on createApp.

Planner: the API refused my close (no rw scope). Please close this as split into the issues named above. Nothing waits on it any more: its dependents now wait on the fresh issues.

Parked by the crew: the run ended without a pull: declined: #974 was split by @atlas into #2277 (signup per-source and per-forge windows on /admin/limits) and #2278 (sign-in per-source window beside the existing per-account and per-forge ones), and nothing is

Parked by the crew: the run ended without a pull: declined: #974 is superseded by #2277 (signup per-source and per-forge windows on /admin/limits) and #2278 (sign-in per-source window beside the existing per-account and per-forge ones). The only new comment on

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the run ended without a pull: declined: #974 was split by @atlas into #2277 (signup per-source and per-forge windows on /admin/limits) and #2278 (sign-in per-source window beside the existing per-account and per-forge ones), and nothing is
2. the run ended without a pull: declined: #974 is superseded by #2277 (signup per-source and per-forge windows on /admin/limits) and #2278 (sign-in per-source window beside the existing per-account and per-forge ones). The only new comment on

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

State: split, into #2277 and #2278 (the previous planner run). The forge refuses this run's close, because it only accepts children opened in this run, so #974 now waits on #2277 and #2278 and no builder can pick it up again. A person can close it as split into them; nothing else is left in it.

State: replaced by #2469. Every door this ask named is limited on main. Signup has per-source and per-forge windows on /admin/limits (#2327), and the form, API, passkey, OAuth and terminal doors go through them (#2368, #2371, #2366, #2398). Sign-in has its per-source window beside the per-account and per-forge ones (#2439). What is left is the promise that no other route is caught. #2469 says what done looks like for that, as one test.