Make self-service signup opt-in via SIGNUP_ENABLED

/users/signup answers 403 unless SIGNUP_ENABLED is set. A public
GET /utils/config/ tells the login page, which hides the sign-up link,
and the signup page explains that an administrator creates accounts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

frontend/src/client/schemas.gen.ts

@@ -2961,6 +2961,19 @@ export const PrivateUserCreateSchema = {
     title: 'PrivateUserCreate'
 } as const;
 
+export const PublicConfigSchema = {
+    properties: {
+        signup_enabled: {
+            type: 'boolean',
+            title: 'Signup Enabled'
+        }
+    },
+    type: 'object',
+    required: ['signup_enabled'],
+    title: 'PublicConfig',
+    description: 'What a browser needs to know about this instance before signing in.'
+} as const;
+
 export const RegisteredClientSchema = {
     properties: {
         id: {

frontend/src/client/types.gen.ts

@@ -1006,6 +1006,13 @@ export type PrivateUserCreate = {
     is_verified?: boolean;
 };
 
+/**
+ * What a browser needs to know about this instance before signing in.
+ */
+export type PublicConfig = {
+    signup_enabled: boolean;
+};
+
 /**
  * A registered agent, and whether anyone actually let it in.
  */
@@ -2156,6 +2163,8 @@ export type UtilsTestEmailData = {
 
 export type UtilsTestEmailResponse = (Message);
 
+export type UtilsReadConfigResponse = (PublicConfig);
+
 export type UtilsHealthCheckResponse = (boolean);
 
 export type UtilsHealthResponse = ({