feat(signup): add Gleam signup service gated by shared invite code

A small Gleam HTTP server in signup/ exposes POST /signup that validates
a shared INVITE_CODE env var, then PUTs a user document to CouchDB's
_users database using the existing admin credentials. The frontend gets
back 201 + the username and is expected to call /_session itself to
obtain the AuthSession cookie (chosen over server-side cookie forwarding
because vaquant.at and couch.apoena.dev are different sites and the
cross-site cookie path is fragile under modern browser privacy modes).

Wired into docker-compose as a second service, reachable on
signup-couch.apoena.dev with its own Traefik labels and the same
hardcoded UUID network attachment as couchdb. Reuses COUCHDB_USER /
COUCHDB_PASSWORD for the admin call. INVITE_CODE must be set in Coolify
env vars.

signup/Dockerfile

@@ -0,0 +1,13 @@
+FROM ghcr.io/gleam-lang/gleam:v1.7.0-erlang-alpine AS builder
+WORKDIR /build
+COPY gleam.toml ./
+RUN gleam deps download
+COPY src ./src
+RUN gleam export erlang-shipment
+
+FROM erlang:27-alpine
+RUN apk add --no-cache openssl-dev
+WORKDIR /app
+COPY --from=builder /build/build/erlang-shipment .
+EXPOSE 8080
+ENTRYPOINT ["/app/entrypoint.sh", "run"]