Sign up with a username and a password; email optional #2951

A stranger can now sign up with a username and a password on an open forge, with no email and no passkey. tsc is clean, the new suite passes (8 tests), and 189 tests across the signup, invite, verify-email, first-admin, TUI and edge suites pass. I did not run the whole bun test; the forge's check runs it.

What changed

• Signup: /signup, POST /api/v1/users and the terminal take {username, password, email?}. The password must be at least 12 characters and is hashed with argon2id. An invite forge still needs the invite, and a closed one refuses.
• Email: it is optional. When given it must look like an address, and the existing verify mail goes out. An address ending in .invalid is refused.
• Accounts with no email: they get a stand-in address (<username>@no-email.invalid), because the email column is NOT NULL UNIQUE and an empty value would collide. They are marked verified from the start; otherwise they could never create anything. Adding a real email later puts them back through verification.
• Passkey: a "Create account with a passkey" button shows beside the password form wherever the browser supports it. It still needs an email.
• Edge: no FORGE_EDGE_* or origin config is needed anywhere in the path. The new suite runs with none.
• Production default: main.ts no longer sets passkeyOnlySignup, because that setting is what blocked password signup in production. It stays as an opt-in for operators who want passkey-only signup, and README.md and the comment in src/app.ts say so.
• Comment: the comment in signUp that said password sign-in was going away (#1618) now says it stays.
• API cross-origin check: POST /api/v1/users had no cross-origin check, so I added one. A POST with a foreign Origin now gets 403. Requests with no Origin header, like curl, still work.
• Sign-in: unchanged. It already goes through verifyPasswordThrottled.

Tests test/signup-password.test.ts covers these cases:

• An account with neither passkey nor email is created and signs in.
• A second account with no email does not collide with the first.
• A given email gets the verify mail and starts unproven.
• A malformed or .invalid email is refused.
• An 11-character password is refused.
• The web form signs up with no email and sets an HttpOnly session.
• A cross-origin POST is refused, for both the API and the form.
• A closed forge refuses.

Left out

• The 12-character minimum applies to signup only. Changing a password and the core minimum are still 10, to avoid locking out existing accounts.
• Passkey signup still requires an email.
• Without a passkey or an email an account has no recovery path, so a lost password means the account is lost.

Try it curl -XPOST $URL/api/v1/users -H 'content-type: application/json' -d '{"username":"ada","password":"twelve-chars-ok"}', or open /signup.

Closes #2923

A stranger can now sign up with a username and a password on an open forge, with no email and no passkey. tsc is clean, the new suite passes (8 tests), and 189 tests across the signup, invite, verify-email, first-admin, TUI and edge suites pass. I did not run the whole bun test; the forge's check runs it.

What changed

• Signup: /signup, POST /api/v1/users and the terminal take {username, password, email?}. The password must be at least 12 characters and is hashed with argon2id. An invite forge still needs the invite, and a closed one refuses.
• Email: it is optional. When given it must look like an address, and the existing verify mail goes out. An address ending in .invalid is refused.
• Accounts with no email: they get a stand-in address (<username>@no-email.invalid), because the email column is NOT NULL UNIQUE and an empty value would collide. They are marked verified from the start; otherwise they could never create anything. Adding a real email later puts them back through verification.
• Passkey: a "Create account with a passkey" button shows beside the password form wherever the browser supports it. It still needs an email.
• Edge: no FORGE_EDGE_* or origin config is needed anywhere in the path. The new suite runs with none.
• Production default: main.ts no longer sets passkeyOnlySignup, because that setting is what blocked password signup in production. It stays as an opt-in for operators who want passkey-only signup, and README.md and the comment in src/app.ts say so.
• Comment: the comment in signUp that said password sign-in was going away (#1618) now says it stays.
• API cross-origin check: POST /api/v1/users had no cross-origin check, so I added one. A POST with a foreign Origin now gets 403. Requests with no Origin header, like curl, still work.
• Sign-in: unchanged. It already goes through verifyPasswordThrottled.

Tests test/signup-password.test.ts covers these cases:

• An account with neither passkey nor email is created and signs in.
• A second account with no email does not collide with the first.
• A given email gets the verify mail and starts unproven.
• A malformed or .invalid email is refused.
• An 11-character password is refused.
• The web form signs up with no email and sets an HttpOnly session.
• A cross-origin POST is refused, for both the API and the form.
• A closed forge refuses.

Left out

• The 12-character minimum applies to signup only. Changing a password and the core minimum are still 10, to avoid locking out existing accounts.
• Passkey signup still requires an email.
• Without a passkey or an email an account has no recovery path, so a lost password means the account is lost.

Try it curl -XPOST $URL/api/v1/users -H 'content-type: application/json' -d '{"username":"ada","password":"twelve-chars-ok"}', or open /signup.

This update fixes all three of sentinel's findings. tsc --noEmit is clean and bun test over the sign-up, users and terminal suites passes (399 tests). I did not run the whole suite, and I did not try the preview.

Sign-up with a username and a password; email optional. Sign-up takes {username, password, email?} on /signup, POST /api/v1/users and in the terminal. The password is hashed with argon2id and needs 12 characters. The passkey stays beside it.

What changed in this round

• High, the verify gate: an account that gives no email now starts unverified, the same as one with an unproven email. It can sign up, sign in and look around, but requireVerified refuses it a create with unverified. Adding and proving an email in settings is what unlocks creating. Settings shows such an account "Add your email below" instead of a "send another link" button, because there is no real address to send to. The test an account with neither passkey nor email signs up and signs in now expects emailVerified === false. It also checks that requireVerified returns unverified.
• Medium, the stand-in address: updateProfile now refuses any .invalid address, so one account can't take another's stand-in or a leftover from a rename. The settings form shows a stand-in as empty. Saving it empty keeps the stand-in instead of failing with an invalid-email error. givenEmail and updateProfile share one isStandInEmail helper. A new test covers taking someone else's stand-in, taking any .invalid address, and saving the empty field.
• Low, the terminal message: the shared weak_password text goes back to the 10-character minimum for password change. The terminal sign-up screen shows its own "sign-up needs 12 characters" message.

What I left out: an operator setting that lets accounts with no email create. As sentinel says, that belongs in its own issue.

The failing check was a test that was too broad. The code was fine, so I changed the test, not the code. I pushed the fix and ran test/turnstile.test.ts (12 pass). I did not re-run the other shards, including the three that exited 143 without naming a test, so I can't say whether they pass.

turnstile doors > off, the page has no widget and the policy is unchanged searched the /signup page for the text cf-turnstile. The page now carries the passkey script, and that script reads the cf-turnstile-response field. So the text appears even with Turnstile off. The test now looks for class="cf-turnstile, which is the actual widget element. It still fails if the widget renders when Turnstile is off.

Everything else from the earlier round is unchanged:

• Sign-up: /signup, POST /api/v1/users and the terminal take {username, password, email?}. The password is hashed with argon2id and must be at least 12 characters. The passkey sign-up stays beside it.
• No-email accounts: they start unverified, so requireVerified refuses them a create until an email is added and proven in settings.
• Settings: .invalid stand-in addresses can't be taken in settings, and the form shows a stand-in as empty.
• Terminal: sign-up has its own "needs 12 characters" message.

I left out an operator setting that would let no-email accounts create. That needs its own issue.

I added the missing terminal test and named the message, and pushed. tsc --noEmit is clean and test/tui-signup-edge.test.ts passes (2 tests). I did not run the other suites for this round.

• Test: a new case in test/tui-signup-edge.test.ts drives the terminal create form headlessly on a forge with no accounts. With the email left blank and an 11-character password, the screen shows the sign-up message and no account is made. Adding one character and submitting again creates the account, which is unverified, and the screen shows "signed in as nora".
• Message: SIGNUP_WEAK_MESSAGE is now a named constant exported from src/tui/screens/signin.ts. The nested ternary is an if / else if / else, and the test asserts on the constant.
• Not changed: the hand-rolled passkey button at site.ts:370. You marked it non-blocking, and it matches the other passkey buttons in that file. I didn't check whether btn() can take an id.