A test pins the sign-up window: a source over its count waits, a refused try is not counted, and the address is the socket's #6880

I added test/signup-window.test.ts, which pins the sign-up window; no source code changed. All 7 tests pass and bun x tsc --noEmit is clean. I did not run the full check.

• Per-source window: a source that has used its count gets the seconds to wait, and waitText words them. A different address, and a different IPv6 address in another /64, is still let in. An IPv6 address in the same /64 shares the first one's count.
• Refused tries: repeated refused tries neither lengthen the wait nor take up the count. Once the wait passes, the source gets its full count again.
• Forge-wide window: it refuses whoever asks once it is spent, and frees up when the minute is over.
• Typed X-Forwarded-For: this goes through a real POST /signup on a served app. The proxy trust list excludes the test client's loopback address, so any header it types is ignored. The first sign-up succeeds. A second one with a different typed address gets a 429 with retry-after and makes no account.
• Slots:

- createUser from the signup and passkey doors with no slot throws and makes no account. - A slot makes one account, and reusing it throws and makes none. - SignupSlot.take returns the seconds to wait when the window is spent.

• Clock: tests use setSystemTime, because signupWindow has no now parameter. The RateLimiter reads Date.now.

A hole I left alone: the "look-alike object can't pass for a slot" guarantee holds only at compile time. At runtime, a plain object with spent and spend passes as a slot, so createUser accepts it. I removed that assertion from the test instead of changing the code. Closing it would mean a runtime instanceof check in core/users.ts, which would import from actions/. That is a design call, and I'd rather it be a separate issue.

Closes #6851

I added test/signup-window.test.ts, which pins the sign-up window; no source code changed. All 7 tests pass and bun x tsc --noEmit is clean. I did not run the full check.

• Per-source window: a source that has used its count gets the seconds to wait, and waitText words them. A different address, and a different IPv6 address in another /64, is still let in. An IPv6 address in the same /64 shares the first one's count.
• Refused tries: repeated refused tries neither lengthen the wait nor take up the count. Once the wait passes, the source gets its full count again.
• Forge-wide window: it refuses whoever asks once it is spent, and frees up when the minute is over.
• Typed X-Forwarded-For: this goes through a real POST /signup on a served app. The proxy trust list excludes the test client's loopback address, so any header it types is ignored. The first sign-up succeeds. A second one with a different typed address gets a 429 with retry-after and makes no account.
• Slots:

- createUser from the signup and passkey doors with no slot throws and makes no account. - A slot makes one account, and reusing it throws and makes none. - SignupSlot.take returns the seconds to wait when the window is spent.

• Clock: tests use setSystemTime, because signupWindow has no now parameter. The RateLimiter reads Date.now.

A hole I left alone: the "look-alike object can't pass for a slot" guarantee holds only at compile time. At runtime, a plain object with spent and spend passes as a slot, so createUser accepts it. I removed that assertion from the test instead of changing the code. Closing it would mean a runtime instanceof check in core/users.ts, which would import from actions/. That is a design call, and I'd rather it be a separate issue.