signup codes: admin-issued invite codes + site /join redemption

Port the December signup-code feature to the 2020.03 branch.

While account creation is disabled, the only way in is now an
admin-issued single-use signup code, redeemed on the public site's /join
page. Because the 2020.03 watch login is device-id-bound with no code
field, a new device refused at the signups-disabled gate (PlatformLogin /
account create) is stashed in a PendingDevices table keyed by the real
client IP (CF-Connecting-IP aware). The /join page shows the player the
device their own client just reported; they enter code + username and the
account is minted bound to that device, so the next launch logs straight
in. No watch changes.

- SignupCodeEntity + PendingDeviceEntity; tables created via idempotent
  CREATE TABLE IF NOT EXISTS at boot (Program.cs Postgres patch block +
  SQLite path) since they post-date the migration chain.
- SignupCodeService: generate / list / revoke / redeem + pending-device
  capture (single-use, expiry, revoke validation).
- Admin: GET/POST signup-codes + revoke endpoints and a Signup codes
  admin-ui page (generate with descriptor/expiry, status table, revoke).
- Public: anonymous /api/site/v1/join pending-devices + redeem, and a
  /join site page (+ header link).
- README documents the flow.

DorkNet.Server/Controllers/API/Account/AccountApiController.cs

@@ -19,6 +19,7 @@ public class AccountApiController(
     DorkNetDbContext db,
     NotificationService notifications,
     ServerSettingsService settings,
+    SignupCodeService signupCodes,
     ILogger<AccountApiController> logger) : ControllerBase
 {
     [HttpPost("api/account/v1/create")]
@@ -37,6 +38,8 @@ public class AccountApiController(
             logger.LogInformation(
                 "[api-account] api/account/v1/create refused — signups disabled (device={Device} platform={Platform})",
                 deviceId, platform);
+            await signupCodes.RecordPendingDeviceAsync(
+                deviceId, platform, platformId, SignupCodeService.ClientIp(HttpContext));
             return Ok(new CreateAccountResponse
             {
                 Success = false,

DorkNet.Server/Controllers/API/PlatformLogin/V2/PlatformLoginController.cs

@@ -28,6 +28,7 @@ public class PlatformLoginController(
     PlayerService playerService,
     AuthService authService,
     ServerSettingsService settings,
+    SignupCodeService signupCodes,
     DorkNetDbContext db) : ControllerBase
 {
     // Login.LoginToAccount → POST api/platformlogin/v2 / v5
@@ -55,6 +56,10 @@ public class PlatformLoginController(
         if (await settings.AreSignupsDisabledAsync()
             && await playerService.GetByDeviceAsync(DeviceId) is null)
         {
+            // Stash the refused device so the player can claim it on the
+            // /join page (matched by IP) with a signup code.
+            await signupCodes.RecordPendingDeviceAsync(
+                DeviceId, Platform, PlatformId, SignupCodeService.ClientIp(HttpContext));
             return Unauthorized(new LoginResponse
             {
                 Error = "signups_disabled",