signup codes: admin-issued invite codes + site /join redemption

While account creation is disabled, the only way in is now an
admin-issued single-use signup code (Discord-invite style), redeemed on
the public site's /join page.

Because the 2020 watch login is device-id-bound with no code field, the
flow captures it server-side instead: a new device refused at the
signups-disabled gate (PlatformLogin / account create) is stashed in a
PendingDevices table keyed by the real client IP (CF-Connecting-IP aware).
The /join page then shows the player the device their own client just
reported, they enter their code + username, and the account is minted
bound to that device — so the next launch logs straight in via the
existing device-id path. No watch changes.

- SignupCodeEntity (code, descriptor, optional expiry, redeemer) +
  PendingDeviceEntity; idempotent CREATE TABLE in DatabaseBootstrap so
  both providers pick them up without a new migration.
- SignupCodeService: generate / list / revoke / redeem + pending-device
  capture, single-use + expiry + revoke validation.
- Admin: GET/POST signup-codes + revoke endpoints and a Signup codes
  admin-ui page (generate with descriptor/expiry, status table, revoke).
- Public: anonymous /api/site/v1/join pending-devices + redeem, and a
  /join site page (+ header link).
- README documents the flow + the post-Initial table-create approach.

DorkNet.Server/Data/Entities/PendingDeviceEntity.cs

@@ -0,0 +1,28 @@
+namespace DorkNet.Server.Data.Entities;
+
+/// <summary>
+/// A device that tried to log in / create an account while signups were
+/// disabled and got refused (it has no account yet). Recorded so the
+/// public <c>/join</c> page can show a player the device id their own
+/// game client just reported — matched by request IP — instead of making
+/// them dig the Unity <c>deviceUniqueIdentifier</c> out of Player.log by
+/// hand. Purely a UX aid for the signup-code redeem flow; rows are
+/// upserted by <c>DeviceId</c> and can be pruned freely.
+/// </summary>
+public class PendingDeviceEntity
+{
+    public long Id { get; set; }
+
+    /// <summary>The Unity device id the refused client sent.</summary>
+    public string DeviceId { get; set; } = string.Empty;
+
+    public int Platform { get; set; }
+    public string PlatformId { get; set; } = string.Empty;
+
+    /// <summary>Last request IP the refusal came from — the /join page
+    /// matches on this so a player sees their own device.</summary>
+    public string? LastIp { get; set; }
+
+    public DateTime FirstSeenAt { get; set; } = DateTime.UtcNow;
+    public DateTime LastSeenAt { get; set; } = DateTime.UtcNow;
+}

DorkNet.Server/Data/Entities/SignupCodeEntity.cs

@@ -0,0 +1,40 @@
+namespace DorkNet.Server.Data.Entities;
+
+/// <summary>
+/// An admin-issued, single-use signup code (Discord-invite style). While
+/// the server has signups disabled, the only way to mint a new account is
+/// to redeem one of these on the public site's <c>/join</c> page. Each
+/// code carries a free-text <see cref="Descriptor"/> so admins can track
+/// who they handed it to, an optional <see cref="ExpiresAt"/>, and the
+/// redemption result (<see cref="RedeemedByPlayerId"/> /
+/// <see cref="RedeemedAt"/>). Codes can be revoked before use.
+/// </summary>
+public class SignupCodeEntity
+{
+    public long Id { get; set; }
+
+    /// <summary>The opaque code string the player types on /join.
+    /// Uppercase, hyphenated, unambiguous alphabet (no 0/O/1/I).</summary>
+    public string Code { get; set; } = string.Empty;
+
+    /// <summary>Free-text note for the admin — "who is this for". Shown
+    /// only in the admin panel, never to the redeemer.</summary>
+    public string Descriptor { get; set; } = string.Empty;
+
+    /// <summary>Player id of the admin who generated the code (0 if
+    /// generated by a system/CLI path).</summary>
+    public long CreatedByPlayerId { get; set; }
+
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+
+    /// <summary>Optional hard expiry. Null = never expires.</summary>
+    public DateTime? ExpiresAt { get; set; }
+
+    /// <summary>Set once the code is redeemed; null while unused.</summary>
+    public long? RedeemedByPlayerId { get; set; }
+    public DateTime? RedeemedAt { get; set; }
+
+    /// <summary>Admin kill switch — a revoked code can never be redeemed,
+    /// even if otherwise valid.</summary>
+    public bool Revoked { get; set; }
+}