flagon-io/g1t

Closes #490.

What changes

• A switch, not code. Sudo's new Access requests page (/waitlist, under Customers) opens with a sign-up switch: open to everyone or invite only (private preview), with who flipped it last. One button flips it. The setting is kept in identity's new identity_settings table (migration 0056). It takes effect within a minute with no deploy, and each flip goes in sudo's audit log under flagon-io (registration_changed). Until anyone has flipped it, identity's REGISTRATION_MODE var applies: invite on g1t.sh, and open by default and on self-hosted installs.
• The gate. In private preview, create_account (the only place an account is made) refuses an account without an invite for its own address. That covers password sign-up and GitHub alike. An invite can come from a workspace or repository invitation, Invite a friend, or staff approving a request. GitHub refuses up front, before the person picks a username.
• Request access. In private preview, /register shows a Request access form (email, plus an optional "What will you build?") instead of the account form. Requests go in the existing waitlist table, one row per address. The person gets one confirmation email.
• Staff email. New requests are summarised to WAITLIST_NOTIFY_EMAIL at most once every 15 minutes. A summary is sent by the next request that finds one due, or failing that by identity's 15-minute sweep, so a lone request is never held back.
• The queue. Sudo's queue has Waiting (oldest first, with a sidebar count), Invited, Dismissed and All, plus search. Approve and invite emails an invite bound to the address with an optional note. Dismiss tells nobody. A row shows Joined as @them once its invite is used.
• Site and docs. The site checks the mode once a minute per isolate, and its sign-up buttons say "Request access" while the preview is on. The docs say g1t.sh is in private preview.
• Self-hosting. The compose file and configs pass REGISTRATION_MODE (default open) and WAITLIST_NOTIFY_EMAIL (default empty), so self-hosted installs never inherit g1t.sh's settings.
• Smoke test. It passes in either mode, and it posts the Request access form an address that identity refuses before writing or counting anything.

Checked

• cargo test -p g1t-identity --lib: 236 pass.
• cargo test -p g1t-contracts: 394 pass.
• Identity's wasm32 check passes.
• Web typecheck passes; web tests: 1248 pass, 1 skipped.
• Sudo typecheck passes; sudo tests: 189 pass.
• Smoke tests pass.
• Prettier is clean on changed files.

Not run end to end against a live stack.