signup codes: admin-issued invite codes + site /join redemption

While account creation is disabled, the only way in is now an
admin-issued single-use signup code (Discord-invite style), redeemed on
the public site's /join page.

Because the 2020 watch login is device-id-bound with no code field, the
flow captures it server-side instead: a new device refused at the
signups-disabled gate (PlatformLogin / account create) is stashed in a
PendingDevices table keyed by the real client IP (CF-Connecting-IP aware).
The /join page then shows the player the device their own client just
reported, they enter their code + username, and the account is minted
bound to that device — so the next launch logs straight in via the
existing device-id path. No watch changes.

- SignupCodeEntity (code, descriptor, optional expiry, redeemer) +
  PendingDeviceEntity; idempotent CREATE TABLE in DatabaseBootstrap so
  both providers pick them up without a new migration.
- SignupCodeService: generate / list / revoke / redeem + pending-device
  capture, single-use + expiry + revoke validation.
- Admin: GET/POST signup-codes + revoke endpoints and a Signup codes
  admin-ui page (generate with descriptor/expiry, status table, revoke).
- Public: anonymous /api/site/v1/join pending-devices + redeem, and a
  /join site page (+ header link).
- README documents the flow + the post-Initial table-create approach.

README.md

@@ -132,6 +132,22 @@ go in [`DorkNet.Server/Data/LegacyUpgrades.cs`](DorkNet.Server/Data/LegacyUpgrad
 See [`DorkNet.Server/Data/MIGRATIONS.md`](DorkNet.Server/Data/MIGRATIONS.md)
 for the full discipline.
 
+Tables added after the consolidated `Initial` migration (e.g.
+`SignupCodes` / `PendingDevices`) are created by an idempotent
+`CREATE TABLE IF NOT EXISTS` step in
+[`Startup/DatabaseBootstrap.cs`](DorkNet.Server/Startup/DatabaseBootstrap.cs)
+so both providers pick them up on existing DBs without a new migration
+(the Postgres path is `EnsureCreated`-only and never replays migrations).
+
+### Signup codes
+
+When account creation is disabled (admin **Server settings**), the only
+way in is an admin-issued single-use **signup code**: generate one in the
+admin panel's **Signup codes** page (with a descriptor + optional expiry),
+hand it to the player, and they redeem it on the site's **`/join`** page —
+which creates their account bound to the device their game client
+reported, so the next launch logs straight in.
+
 ---
 
 ## Contributing