feat: age verification with an ID document (Didit), and closed registration

Age: a Didit provider behind the vendor-neutral age interface. A person
verifies once (ID document, passive liveness, face match) and all their
linked IMVU accounts count as adult. Webhooks are checked against Didit's
signatures; only "over 18" is kept. A later answer replaces an earlier one
(an approval taken back is revoked). Checks are limited: one unfinished
check per person, 3 in 30 days, none once verified, and a monthly cap
(DIDIT_MONTHLY_LIMIT, default 30: Didit's free plan is $10 of credit a
month and a check costs $0.30). The Account page gets an Age Verification
card.

Registration: open or closed, an admin's setting in the console
(default from REGISTRATION). Closed: new accounts can only sign in until
a moderator approves them (or declines, deleting the account); the
website shows them a waiting page and the API treats them as signed out.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docker-compose.yml

@@ -22,6 +22,13 @@ services:
       # T5DE's proxies reach the API directly (sign-in and the WebSocket); the website reaches it through its own /api.
       API_URL: ${API_PUBLIC_URL:-http://localhost:4101}
       WEB_URL: ${WEB_PUBLIC_URL:-http://localhost:4100}
+      # open, or closed (new accounts wait for a moderator's approval) until an admin changes it in the console.
+      REGISTRATION: ${REGISTRATION:-open}
+      # Ways to verify age (apps/api/src/index.ts): imvu, and didit with its keys.
+      AGE_PROVIDERS: ${AGE_PROVIDERS:-imvu}
+      DIDIT_API_KEY: ${DIDIT_API_KEY:-}
+      DIDIT_WORKFLOW_ID: ${DIDIT_WORKFLOW_ID:-}
+      DIDIT_WEBHOOK_SECRET: ${DIDIT_WEBHOOK_SECRET:-}
     ports: ["4101:4101"]
     depends_on:
       postgres: { condition: service_healthy }