Add self-service sign-up and invite links

First half of #7. Until now the only way to get an account was for
somebody who already had one to create it, and the login page told people
to "ask an admin" -- workable for one operator, impossible for a team.

Two modes, chosen by an administrator in the settings table: invite_only,
which is the default, and open. A third domain-restricted mode was
considered and dropped, because with no email in this server there is
nothing to verify an address against and it would only check the domain
of a string somebody typed.

The default is the closed door. An install that gets a public hostname
before anybody has thought about sign-up should not be collecting
accounts from the internet, and the failure mode of a typo in the setting
is invite_only rather than open.

An invite is a link, not an email. Adding SMTP to send one message would
be a subsystem to run, secure and monitor; the person inviting sends the
link however they already talk to the person they are inviting. A link
carries the team and the role, because an account in no team sees an
empty queue and can be paged by nobody -- that is not a state to invite
somebody into. Links are single-use by default, expire after seven days,
and can be revoked before that: a link that works forever is a credential
nobody remembers issuing, sitting in a chat log.

The uses counter is incremented inside the sign-up transaction and
guarded by `uses < max_uses`, so two people redeeming the last use at
once cannot both get in.

GET /api/signup reports the mode and whether a link is usable, so the
form can say "this link has expired" before somebody picks a password
rather than after. It gives one answer for expired, revoked, used up and
never existed: telling a stranger which it was tells them something about
links they do not hold.

Sign-up signs you in. The alternative is a form that says "now go and log
in", which is the same credential typed twice. login and signup now share
startSession rather than each minting a cookie.

Rate-limited per address on its own limiter, not login's: a burst of
sign-ups must not lock somebody out of logging in.

The settings table grew a second shape for this. It held only durations;
signup_mode is a word from a fixed list, so the admin endpoint now
validates everything before writing anything -- a request that sets two
settings and gets one wrong changes neither.

Still to come in #7: the sign-up and invite-redemption pages, the
first-run checklist, and the in-app integration instructions. The schema
carries onboarding_dismissed_at for the checklist already.

Claude-Session: https://claude.ai/code/session_01RHPj4ggeFdEjKKfm4SHbD7

internal/api/settings.go

@@ -90,6 +90,16 @@ func SeedSettings(ctx context.Context, db *sql.DB, cfg config.Config) error {
 type settingsResponse struct {
 	Editable map[string]settingValue `json:"editable"`
 	FromEnv  map[string]string       `json:"from_env"`
+
+	// Choices are settings that are a word from a fixed list rather than a
+	// duration. One so far: who may create an account.
+	Choices map[string]choiceValue `json:"choices"`
+}
+
+type choiceValue struct {
+	Value       string   `json:"value"`
+	Options     []string `json:"options"`
+	Description string   `json:"description"`
 }
 
 type settingValue struct {
@@ -104,6 +114,14 @@ func handleGetSettings(db *sql.DB, cfg config.Config) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		out := settingsResponse{
 			Editable: map[string]settingValue{},
+			Choices: map[string]choiceValue{
+				SettingSignupMode: {
+					Value:   signupMode(r.Context(), db),
+					Options: []string{SignupInviteOnly, SignupOpen},
+					Description: "who may create an account: invite_only means a link from a team owner, " +
+						"open means anybody who can reach this server",
+				},
+			},
 			FromEnv: map[string]string{
 				// Never the ntfy token or the DSN: both are credentials, and an
 				// admin page that renders them turns a browser tab into a place
@@ -137,7 +155,7 @@ func handleGetSettings(db *sql.DB, cfg config.Config) http.HandlerFunc {
 // sit in the table looking like configuration and doing nothing.
 func handleSetSettings(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		var req map[string]int64
+		var req map[string]any
 		if err := decodeJSON(r, &req); err != nil {
 			respond(w, http.StatusBadRequest, errResp("invalid request body"))
 			return
@@ -147,17 +165,37 @@ func handleSetSettings(db *sql.DB) http.HandlerFunc {
 			return
 		}
 
-		for key, secs := range req {
-			b, known := settingBounds[key]
-			if !known {
-				respond(w, http.StatusBadRequest, errResp("unknown setting: "+key))
-				return
-			}
-			d := time.Duration(secs) * time.Second
-			if d < b.min || d > b.max {
-				respond(w, http.StatusBadRequest, errResp(
-					key+" must be between "+b.min.String()+" and "+b.max.String()))
-				return
+		// Validate everything before writing anything: a request that sets two
+		// settings and gets one wrong should change neither.
+		values := map[string]string{}
+		for key, raw := range req {
+			switch key {
+			case SettingSignupMode:
+				mode, _ := raw.(string)
+				if mode != SignupOpen && mode != SignupInviteOnly {
+					respond(w, http.StatusBadRequest,
+						errResp("signup_mode must be "+SignupInviteOnly+" or "+SignupOpen))
+					return
+				}
+				values[key] = mode
+			default:
+				b, known := settingBounds[key]
+				if !known {
+					respond(w, http.StatusBadRequest, errResp("unknown setting: "+key))
+					return
+				}
+				secs, ok := raw.(float64) // JSON numbers decode as float64
+				if !ok {
+					respond(w, http.StatusBadRequest, errResp(key+" must be a number of seconds"))
+					return
+				}
+				d := time.Duration(int64(secs)) * time.Second
+				if d < b.min || d > b.max {
+					respond(w, http.StatusBadRequest, errResp(
+						key+" must be between "+b.min.String()+" and "+b.max.String()))
+					return
+				}
+				values[key] = strconv.FormatInt(int64(secs), 10)
 			}
 		}
 
@@ -168,13 +206,13 @@ func handleSetSettings(db *sql.DB) http.HandlerFunc {
 		}
 		defer tx.Rollback() //nolint:errcheck
 
-		for key, secs := range req {
+		for key, value := range values {
 			if _, err := tx.ExecContext(r.Context(), `
 				INSERT INTO settings (key, value, updated_at)
 				VALUES ($1, $2, `+nowEpoch+`)
 				ON CONFLICT (key) DO UPDATE SET
 					value = excluded.value, updated_at = excluded.updated_at`,
-				key, strconv.FormatInt(secs, 10)); err != nil {
+				key, value); err != nil {
 				respond(w, http.StatusInternalServerError, errResp("internal error"))
 				return
 			}