feat(signup): add Gleam signup service gated by shared invite code

A small Gleam HTTP server in signup/ exposes POST /signup that validates
a shared INVITE_CODE env var, then PUTs a user document to CouchDB's
_users database using the existing admin credentials. The frontend gets
back 201 + the username and is expected to call /_session itself to
obtain the AuthSession cookie (chosen over server-side cookie forwarding
because vaquant.at and couch.apoena.dev are different sites and the
cross-site cookie path is fragile under modern browser privacy modes).

Wired into docker-compose as a second service, reachable on
signup-couch.apoena.dev with its own Traefik labels and the same
hardcoded UUID network attachment as couchdb. Reuses COUCHDB_USER /
COUCHDB_PASSWORD for the admin call. INVITE_CODE must be set in Coolify
env vars.

docker-compose.yml

@@ -65,6 +65,33 @@ services:
         put_config cors   methods      'GET, PUT, POST, HEAD, DELETE'
         put_config cors   headers      'accept, authorization, content-type, origin, referer, x-csrf-token'
 
+  signup:
+    build:
+      context: ./signup
+    restart: unless-stopped
+    depends_on:
+      - couchdb
+    environment:
+      SERVICE_FQDN_SIGNUP_8080:
+      COUCHDB_URL: http://couchdb:5984
+      COUCHDB_ADMIN_USER: ${COUCHDB_USER:-admin}
+      COUCHDB_ADMIN_PASSWORD: ${COUCHDB_PASSWORD}
+      INVITE_CODE: ${INVITE_CODE}
+      SIGNUP_ALLOWED_ORIGINS: "http://localhost:8080,http://localhost:5173,http://localhost:3000,http://localhost:4173,https://vaquant.at"
+      PORT: "8080"
+    expose:
+      - "8080"
+    networks:
+      - default
+      - coolify
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=lvw8efvnvsxduodrkg68zul3"
+      - "traefik.http.routers.coolcouch-signup.rule=Host(`signup-couch.apoena.dev`)"
+      - "traefik.http.routers.coolcouch-signup.entrypoints=https"
+      - "traefik.http.routers.coolcouch-signup.tls=true"
+      - "traefik.http.services.coolcouch-signup.loadbalancer.server.port=8080"
+
 networks:
   coolify:
     external: true