feat(provisioning): admin game-signup mode setting, invite link option, staff self-create

Follow-ups from live testing:

- Game-account creation is now an admin Settings control (disabled / website /
  hybrid / game) instead of a hidden on/off flag. The site offers creation for
  website+hybrid; help text notes the shard's SignupMode (Bridge.cfg) has the final
  say. game_account_signup setting widened to a 4-value enum + validated on save.
- Invites: the accept link is ALWAYS returned and shown with a Copy button, and a
  "Email the invitation" toggle lets an admin create a link-only invite (no email)
  or email it. Backend takes sendEmail (default true) and always returns acceptUrl.
- Staff can create a game account from their own /admin/characters page too
  (POST /admin/shard/account → the shared createGameAccount controller), so the
  form is reachable in both the player and admin portals.

Note: the admin Houses view (/admin/houses) already worked; the earlier failure
was a stale Vite HMR state for the new route (needs a hard refresh).

Client build clean; server routes load; swagger regenerated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/model/settings/settings.model.js

@@ -32,11 +32,25 @@ function registrationFlags(mode) {
   }
 }
 
-// Game-account signup (Protocol 2.0 hybrid mode). Off unless an admin opts in;
-// the shard's own signup mode still has the final say when we call the sidecar.
+// Game-account signup (Protocol 2.0). The admin picks who mints game accounts:
+//   disabled — the site never offers game-account creation (link-only).
+//   website  — the site is the authority (offer creation; pair with the shard in
+//              website mode + AutoCreateAccounts=false).
+//   hybrid   — either side may create (the site offers creation).
+//   game     — the game server is the authority; the site does NOT offer creation.
+// The site OFFERS creation only for 'website'/'hybrid'; the shard's own SignupMode
+// (Bridge.cfg) still has the final say and may 403 a call regardless.
 const GAME_SIGNUP_KEY = 'game_account_signup'
+const GAME_SIGNUP_MODES = ['disabled', 'website', 'hybrid', 'game']
+const GAME_SIGNUP_OFFER = ['website', 'hybrid']
+
+async function getGameSignupMode() {
+  const v = await settingsDb.get(GAME_SIGNUP_KEY)
+  return GAME_SIGNUP_MODES.includes(v) ? v : 'disabled'
+}
+
 async function isGameAccountSignupEnabled() {
-  return (await settingsDb.get(GAME_SIGNUP_KEY)) === 'enabled'
+  return GAME_SIGNUP_OFFER.includes(await getGameSignupMode())
 }
 
 async function get(key) {
@@ -73,7 +87,8 @@ async function getPublic() {
   out.registration = registrationFlags(mode)
   // Whether the site offers game-account creation (the shard's own mode still has
   // the final say when the call is made). Lets the portal show/hide the form.
-  out.gameAccountSignup = all[GAME_SIGNUP_KEY] === 'enabled'
+  const gsMode = GAME_SIGNUP_MODES.includes(all[GAME_SIGNUP_KEY]) ? all[GAME_SIGNUP_KEY] : 'disabled'
+  out.gameAccountSignup = GAME_SIGNUP_OFFER.includes(gsMode)
   return out
 }
 
@@ -89,5 +104,7 @@ module.exports = {
   getRegistrationMode,
   registrationFlags,
   GAME_SIGNUP_KEY,
+  GAME_SIGNUP_MODES,
+  getGameSignupMode,
   isGameAccountSignupEnabled,
 }