signup codes: admin-issued invite codes + site /join redemption

While account creation is disabled, the only way in is now an
admin-issued single-use signup code (Discord-invite style), redeemed on
the public site's /join page.

Because the 2020 watch login is device-id-bound with no code field, the
flow captures it server-side instead: a new device refused at the
signups-disabled gate (PlatformLogin / account create) is stashed in a
PendingDevices table keyed by the real client IP (CF-Connecting-IP aware).
The /join page then shows the player the device their own client just
reported, they enter their code + username, and the account is minted
bound to that device — so the next launch logs straight in via the
existing device-id path. No watch changes.

- SignupCodeEntity (code, descriptor, optional expiry, redeemer) +
  PendingDeviceEntity; idempotent CREATE TABLE in DatabaseBootstrap so
  both providers pick them up without a new migration.
- SignupCodeService: generate / list / revoke / redeem + pending-device
  capture, single-use + expiry + revoke validation.
- Admin: GET/POST signup-codes + revoke endpoints and a Signup codes
  admin-ui page (generate with descriptor/expiry, status table, revoke).
- Public: anonymous /api/site/v1/join pending-devices + redeem, and a
  /join site page (+ header link).
- README documents the flow + the post-Initial table-create approach.

DorkNet.Server/Controllers/API/Account/AccountApiController.cs

@@ -19,6 +19,7 @@ public class AccountApiController(
     DorkNetDbContext db,
     NotificationService notifications,
     ServerSettingsService settings,
+    SignupCodeService signupCodes,
     ILogger<AccountApiController> logger) : ControllerBase
 {
     [HttpPost("api/account/v1/create")]
@@ -37,6 +38,8 @@ public class AccountApiController(
             logger.LogInformation(
                 "[api-account] api/account/v1/create refused — signups disabled (device={Device} platform={Platform})",
                 deviceId, platform);
+            await signupCodes.RecordPendingDeviceAsync(
+                deviceId, platform, platformId, SignupCodeService.ClientIp(HttpContext));
             return Ok(new CreateAccountResponse
             {
                 Success = false,

DorkNet.Server/Controllers/API/PlatformLogin/V2/PlatformLoginController.cs

@@ -28,6 +28,7 @@ public class PlatformLoginController(
     PlayerService playerService,
     AuthService authService,
     ServerSettingsService settings,
+    SignupCodeService signupCodes,
     DorkNetDbContext db) : ControllerBase
 {
     // Login.LoginToAccount → POST api/platformlogin/v2 / v5
@@ -55,6 +56,10 @@ public class PlatformLoginController(
         if (await settings.AreSignupsDisabledAsync()
             && await playerService.GetByDeviceAsync(DeviceId) is null)
         {
+            // Stash the refused device so the player can claim it on the
+            // /join page (matched by IP) with a signup code.
+            await signupCodes.RecordPendingDeviceAsync(
+                DeviceId, Platform, PlatformId, SignupCodeService.ClientIp(HttpContext));
             return Unauthorized(new LoginResponse
             {
                 Error = "signups_disabled",

DorkNet.Server/Controllers/Admin/AdminController.cs

@@ -36,6 +36,7 @@ public class AdminController(
     PlayerPresenceService playerPresence,
     PlayerLogService playerLog,
     ServerSettingsService serverSettings,
+    SignupCodeService signupCodes,
     IObjectStorage storage,
     DomainConfig domain,
     ILogger<AdminController> adminLogger) : ControllerBase
@@ -1456,6 +1457,67 @@ public class AdminController(
         return Ok(weekly);
     }
 
+    // ── Signup codes ─────────────────────────────────────────────────────
+
+    /// <summary>GET <c>api/admin/v1/signup-codes</c> — every issued code
+    /// with its status (unused / redeemed-by-whom / revoked / expired)
+    /// for the admin invite tracker.</summary>
+    [HttpGet("signup-codes")]
+    public async Task<ActionResult> GetSignupCodes([FromQuery] int take = 200)
+    {
+        var codes = await signupCodes.ListAsync(take);
+        var redeemerIds = codes.Where(c => c.RedeemedByPlayerId is not null)
+            .Select(c => c.RedeemedByPlayerId!.Value).Distinct().ToList();
+        var redeemers = redeemerIds.Count == 0
+            ? new Dictionary<long, string>()
+            : await db.Players.Where(p => redeemerIds.Contains(p.Id))
+                .ToDictionaryAsync(p => p.Id, p => p.Username);
+
+        var now = DateTime.UtcNow;
+        return Ok(codes.Select(c => new
+        {
+            c.Id,
+            c.Code,
+            c.Descriptor,
+            c.CreatedAt,
+            c.ExpiresAt,
+            c.Revoked,
+            c.RedeemedAt,
+            c.RedeemedByPlayerId,
+            RedeemedByUsername = c.RedeemedByPlayerId is { } rid && redeemers.TryGetValue(rid, out var u) ? u : null,
+            Status = c.RedeemedByPlayerId is not null ? "redeemed"
+                : c.Revoked ? "revoked"
+                : c.ExpiresAt is { } e && e <= now ? "expired"
+                : "active",
+        }));
+    }
+
+    public sealed record GenerateSignupCodeRequest(string? Descriptor, DateTime? ExpiresAt);
+
+    /// <summary>POST <c>api/admin/v1/signup-codes</c> — mint a new
+    /// single-use code with an optional descriptor + expiry.</summary>
+    [HttpPost("signup-codes")]
+    public async Task<ActionResult> GenerateSignupCode([FromBody] GenerateSignupCodeRequest body)
+    {
+        var expires = body.ExpiresAt is { } e ? DateTime.SpecifyKind(e, DateTimeKind.Utc) : (DateTime?)null;
+        var code = await signupCodes.GenerateAsync(body.Descriptor ?? string.Empty, expires, CurrentAdminId);
+        await LogAsync("signup_code_created", "signup_code", code.Id, code.Descriptor);
+        await db.SaveChangesAsync();
+        return Ok(new { code.Id, code.Code, code.Descriptor, code.CreatedAt, code.ExpiresAt });
+    }
+
+    /// <summary>POST <c>api/admin/v1/signup-codes/{id}/revoke</c> — kill an
+    /// unused code. Already-redeemed codes can't be revoked.</summary>
+    [HttpPost("signup-codes/{id:long}/revoke")]
+    public async Task<ActionResult> RevokeSignupCode(long id)
+    {
+        var ok = await signupCodes.RevokeAsync(id);
+        if (!ok) return BadRequest(new { Error = "cannot_revoke" });
+        await LogAsync("signup_code_revoked", "signup_code", id, "");
+        await db.SaveChangesAsync();
+        return Ok(new { Revoked = true });
+    }
+
     // ── Audit log ────────────────────────────────────────────────────────
 
     [HttpGet("audit")]

DorkNet.Server/Controllers/Site/PublicSiteController.cs

@@ -27,6 +27,7 @@ namespace DorkNet.Server.Controllers.Site;
 public class PublicSiteController(
     DorkNetDbContext db,
     PlayerService players,
+    SignupCodeService signupCodes,
     DomainConfig domain) : ControllerBase
 {
     // ── Players ──────────────────────────────────────────────────────
@@ -243,4 +244,41 @@ public class PublicSiteController(
             };
         }).ToList();
     }
+
+    // ── Signup (code redemption) ─────────────────────────────────────
+
+    /// <summary>GET /api/site/v1/join/pending-devices — device ids that
+    /// were refused account creation while signups are disabled, seen
+    /// from THIS caller's IP. Lets the /join page show a player the
+    /// device their own game client just reported so they don't have to
+    /// dig it out of Player.log. Best-effort: behind a proxy that
+    /// collapses client IPs this can be empty, in which case the player
+    /// pastes the id manually.</summary>
+    [HttpGet("join/pending-devices")]
+    public async Task<IActionResult> JoinPendingDevices()
+    {
+        var ip = SignupCodeService.ClientIp(HttpContext);
+        var rows = await signupCodes.RecentPendingByIpAsync(ip);
+        return Ok(rows.Select(d => new
+        {
+            deviceId = d.DeviceId,
+            platform = d.Platform,
+            lastSeenAt = d.LastSeenAt,
+        }).ToList());
+    }
+
+    public sealed record JoinRedeemRequest(string? Code, string? Username, string? DeviceId);
+
+    /// <summary>POST /api/site/v1/join/redeem — redeem a signup code,
+    /// minting an account bound to the supplied device id. On success the
+    /// player relaunches the game and the watch's device-id login finds
+    /// the new account. Returns {ok, error?, username?}.</summary>
+    [HttpPost("join/redeem")]
+    public async Task<IActionResult> JoinRedeem([FromBody] JoinRedeemRequest body)
+    {
+        var result = await signupCodes.RedeemAsync(body.Code, body.Username, body.DeviceId);
+        if (!result.Ok)
+            return BadRequest(new { ok = false, error = result.Error });
+        return Ok(new { ok = true, username = result.Username, playerId = result.PlayerId });
+    }
 }