Gate signup with IDENTITY_SIGNUP_MODE (#78)

[AntoineToussaint]

Closes #78.

Summary

• Signup was unconditionally open self-serve. This adds an identity workspace config key, IDENTITY_SIGNUP_MODE = open | invite | waitlist, that gates provisioning of first-seen identities only — Login and Invite are never gated, so an invitee can always obtain an account while a stranger cannot, and existing users are never locked out.
• open is the default (empty value → open), so upgrading an existing deployment changes nothing. Unrecognised values fail startup closed via auth.ParseSignupMode, consistent with OAuthRequestPolicy/CORS; the parser also returns the most-restrictive mode on error so an ignored error still rejects strangers.
• invite wires the existing invitations subsystem into access control: signup requires a pending, unexpired invitation for the verified email, and the invitee is provisioned into the inviting org. waitlist wires the existing WAITLIST_STATE_* machine in for the first time: signup requires an approved or invited entry.

Implementation notes

• The gate lives in the Postgres resolver's Signup branch, inside the existing serializable auth transaction, so the invitation/waitlist checks are consistent with provisioning. SetSignupMode mirrors the existing SetBootstrapAdminEmail composition setter; work.go reads IDENTITY_SIGNUP_MODE through the Codefly identity configuration and refuses to start on an unrecognised value.
• The invitation membership-and-accept tail is now a shared acceptInvitation helper used by both the token-based invite flow and the invite-mode signup flow.
• Out of scope / non-goal: the invite-mode signup path (email match, no token) does not emit the auth.invitation.accepted business event that the explicit token flow does; the membership and acceptance are still persisted transactionally in the resolver.
• The referenced module/docs/IDENTITY_ACCESS_PLAN.md design doc does not exist in the repo; this change follows the issue's stated scope and the #77 intent split directly.

Test plan

• pure: TestParseSignupMode / TestParseSignupMode_UnrecognisedFailsClosed cover the parser, the empty→open default, and fail-closed on garbage.
• pipeline (real Postgres), one case per mode:
  • open: unknown email signs up successfully
  • invite: unknown email with no invitation is rejected and provisions nothing
  • invite: invited email signs up successfully and lands in the inviting org
  • invite: an existing user can still log in (login is not gated)
  • waitlist: pending entry rejected; approved entry accepted
• Full pkg/auth/pg suite green (confirms the resolveInvite refactor did not regress the token flow).
• node module/tools/base-integrity.mjs check passes; base-manifest.json regenerated for the edited canonical files.

🤖 Generated with Claude Code