Reserved names are held where accounts and orgs are made; seeds opt out by name #935

Closes #720

The reserved-name rule now lives where accounts and orgs are made, so a way in added later inherits it without calling anything.

Where the rule lives

• createUser (core/users.ts) already refused a reserved name for every non-agent account (from #662's round two). It gains reservedSelf: the account naming this one, whose own handle does not count against it. That lets the everyday account drop its separate check.
• createOrg in core/orgs.ts now refuses a reserved name itself (name_reserved), with a named allowReserved opt-out. The separate check in actions/orgs.ts is gone.

Seeds opt out by name, nothing by default: a spawned child's founder (allowReserved: true) and its org ({ allowReserved: true }). The spawner was already held to the rule on the parent. Agents keep their own rule.

Every door

• signup page, signup API and TUI sign-up: signUp → createUser
• edge sign-in: ensureEdgeUser → createUser
• everyday account: createUser with reservedSelf, so the separate call is gone
• claim: createUser; a reserved name now says "That name is reserved." and does not spend the link
• spawned founder and org: the explicit opt-out
• org page, org API and anything else that founds an org: core createOrg

No MCP tool, admin page or import makes accounts today; any added later goes through createUser or createOrg.

Tests (written refusing first)

• reserved-names "an organization is held where it is made (#720)": core createOrg refuses an agent-with-role name without the opt-out and makes a seed with it; the API refuses trevat0, scout-bot and settings with 422.
• everyday "a reserved name makes nothing (#720)": a page's name and another admin's look-alike are refused; the admin's own (ada-me) is still allowed (existing test).
• claim-link: admin is refused with "That name is reserved." and the same link then claims.
• The existing signup page/API, edge and seed opt-out tests stay.
• tsc is clean. Every test file that founds an org, plus spawn*, claim-link, new-forge, verify-email, web-workflows, parity and the cross files: 512 pass.

Widely used signatures: core createOrg gains an optional 4th argument, and CreateUserInput gains optional reservedSelf. Existing callers are unchanged. No hot files.

🤖 Generated with Claude Code