chore(signup): bump wisp/mist to latest, lock with manifest.toml

Two prior deploy failures came from transitive deps drifting on every
fresh build (gleam_httpc 4.1.1 calling result.then, then glisten 8.0.3
calling list.range). The root cause is no manifest.toml — every build
re-resolved deps from scratch and tripped on broken combinations within
the allowed ranges.

- Bump wisp 1.x → 2.x and mist 4.x → 6.x so the resolver picks
  modern, mutually compatible versions of the whole tree
  (stdlib 1.0.3, glisten 9.0.1, httpc 5.0.0).
- Commit manifest.toml so deps are pinned by checksum.
- Adapt to wisp 2.x: json_response now takes String, not StringTree.
- Drop unused gleam/http/response import.
- Add signup/build/ to .gitignore.

.gitignore

@@ -8,3 +8,6 @@
 *.swp
 *.swo
 .DS_Store
+
+# gleam build artifacts
+signup/build/