feat: age verification with an ID document (Didit), and closed registration

Age: a Didit provider behind the vendor-neutral age interface. A person
verifies once (ID document, passive liveness, face match) and all their
linked IMVU accounts count as adult. Webhooks are checked against Didit's
signatures; only "over 18" is kept. A later answer replaces an earlier one
(an approval taken back is revoked). Checks are limited: one unfinished
check per person, 3 in 30 days, none once verified, and a monthly cap
(DIDIT_MONTHLY_LIMIT, default 30: Didit's free plan is $10 of credit a
month and a check costs $0.30). The Account page gets an Age Verification
card.

Registration: open or closed, an admin's setting in the console
(default from REGISTRATION). Closed: new accounts can only sign in until
a moderator approves them (or declines, deleting the account); the
website shows them a waiting page and the API treats them as signed out.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/signup/page.tsx

@@ -1,15 +1,20 @@
 import type { Metadata } from "next";
 import { redirect } from "next/navigation";
 import { NarrowCard } from "@/components/narrow-card";
-import { getMe } from "@/lib/api";
+import { api, getMe, unwrap } from "@/lib/api";
 import { SignUpForm } from "./signup-form";
 
 export const metadata: Metadata = { title: "Create account" };
 
 export default async function SignUp() {
   if (await getMe()) redirect("/account");
+  const { registration } = unwrap(await api.hub.get());
+  const description =
+    registration === "closed"
+      ? "One T5DE account for all your IMVU accounts. New accounts need a moderator's approval."
+      : "One T5DE account for all your IMVU accounts.";
   return (
-    <NarrowCard title="Create account" description="One T5DE account for all your IMVU accounts.">
+    <NarrowCard title="Create account" description={description}>
       <SignUpForm />
     </NarrowCard>
   );