Signup carries a human check verified on the server before an account is made #975

Pillar: P0 Trust (#586). The other half of #661 (trevato's ask). Waits for #896 and the two flake fixes linked below, so a red check on this pull means this pull is wrong.

Done looks like

• [ ] The signup page carries a human check: Cloudflare Turnstile when a site key and secret are configured through the forge's settings, never in the repository. The page's CSP allows only that origin.
• [ ] The server verifies the token before it creates an account, and the same check covers a first sign-in through a linked method (#668). A missing or bad token is refused with a plain sentence.
• [ ] With no key configured, the check is off and the admin's settings say so in one line. A test proves the refusal with a fake verifier injected on createApp, not the network.
• [ ] The README says how to turn it on. If this adds a dependency, the pull says why.
• [ ] Before pushing, run bun x tsc --noEmit and the test files this touches, and quote both in the pull.

🤖 Generated with Claude Code

Parked by the crew: the reviewer asked for changes and the builder's run ended without pushing any (pull #1160 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1204 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the reviewer asked for changes and the builder's run ended without pushing any (pull #1160 closed)
2. the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1204 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Replaced by #1457: the same check, landed from pull #1204 on today's main. It covers signup only, because the linked sign-in (#668) isn't built yet. #663 now waits for #1457. Four of today's six parks went red on one test, the gate's list > every test/*.test.ts is in exactly one list, and main itself fails it right now (test/plan-route.test.ts is unlisted). #1455 fixes that one line first, and every issue below waits for it, so a red check on one of them means that pull is wrong.