signup codes: admin-issued invite codes + site /join redemption

Port the December signup-code feature to the 2020.03 branch.

While account creation is disabled, the only way in is now an
admin-issued single-use signup code, redeemed on the public site's /join
page. Because the 2020.03 watch login is device-id-bound with no code
field, a new device refused at the signups-disabled gate (PlatformLogin /
account create) is stashed in a PendingDevices table keyed by the real
client IP (CF-Connecting-IP aware). The /join page shows the player the
device their own client just reported; they enter code + username and the
account is minted bound to that device, so the next launch logs straight
in. No watch changes.

- SignupCodeEntity + PendingDeviceEntity; tables created via idempotent
  CREATE TABLE IF NOT EXISTS at boot (Program.cs Postgres patch block +
  SQLite path) since they post-date the migration chain.
- SignupCodeService: generate / list / revoke / redeem + pending-device
  capture (single-use, expiry, revoke validation).
- Admin: GET/POST signup-codes + revoke endpoints and a Signup codes
  admin-ui page (generate with descriptor/expiry, status table, revoke).
- Public: anonymous /api/site/v1/join pending-devices + redeem, and a
  /join site page (+ header link).
- README documents the flow.

README.md

@@ -125,6 +125,18 @@ Compared to `december-2020-12-18`, this branch's server is closer to
 the original 2020-Q1 wire shape — fewer endpoints, simpler entities,
 and the multi-step migrations haven't been consolidated.
 
+### Signup codes
+
+When account creation is disabled (admin **Server settings**), the only
+way in is an admin-issued single-use **signup code**: generate one in the
+admin panel's **Signup codes** page (with a descriptor + optional expiry),
+hand it to the player, and they redeem it on the site's **`/join`** page —
+which creates their account bound to the device their game client
+reported, so the next launch logs straight in. The `SignupCodes` /
+`PendingDevices` tables post-date the migration chain and are created by
+an idempotent `CREATE TABLE IF NOT EXISTS` step at boot (Program.cs), so
+existing SQLite/Postgres DBs pick them up without a new migration.
+
 ---
 
 ## Contributing