fix: fail closed on production signup

Production configuration accepted publicSignupEnabled: true and started a
working Identity/API runtime, even though Ekklesia has no verified email,
invitation requirement, CAPTCHA, or durable shared/edge limiter — Doctor
merely reported "Public signup is explicitly ENABLED" as a pass.

validatePublicSignupEnabled now takes the same IdentityEnvironment the rest
of this config validates against and throws the stable
PUBLIC_SIGNUP_UNSUPPORTED_IN_PRODUCTION whenever the parsed value is true in
production. Parsing stays separate from the policy, so a malformed value
still reports PUBLIC_SIGNUP_ENABLED_INVALID everywhere. Because the
executable entry point validates configuration before startApi, such a
deployment fails before any pool, Better Auth instance, module runtime, or
listener exists, and Doctor reports NOT READY via its existing
IdentityConfigError path. Development and test composition still enable it
explicitly through the identical typed path.

Co-Authored-By: Claude Opus 5 <[email protected]>

core/tests/doctor.test.ts

@@ -635,7 +635,27 @@ describe("Ekklesia Doctor diagnostics", () => {
     );
   });
 
-  it("reports public signup as explicitly enabled when configured", async () => {
+  it("reports public signup as explicitly enabled when configured in development", async () => {
+    const report = await diagnoseEkklesia(
+      {
+        ...options(),
+        identityConfiguration: {
+          baseUrl: "http://localhost:3000",
+          environment: "development",
+          publicSignupEnabled: "true",
+          secret: "correct-horse-battery-staple-0123456789",
+          trustedOrigins: ["http://localhost:3000"],
+        },
+      },
+      dependencies(),
+    );
+
+    const identity = check(report, "identity.configuration");
+    expect(identity.status).toBe("pass");
+    expect(identity.details.some((detail) => detail.includes("explicitly ENABLED"))).toBe(true);
+  });
+
+  it("blocks readiness — not merely warns — when production configuration enables public signup", async () => {
     const report = await diagnoseEkklesia(
       {
         ...options(),
@@ -651,8 +671,12 @@ describe("Ekklesia Doctor diagnostics", () => {
     );
 
     const identity = check(report, "identity.configuration");
-    expect(identity.status).toBe("pass");
-    expect(identity.details.some((detail) => detail.includes("explicitly ENABLED"))).toBe(true);
+    expect(identity.status).toBe("failure");
+    expect(
+      identity.details.some((detail) => detail.includes("PUBLIC_SIGNUP_UNSUPPORTED_IN_PRODUCTION")),
+    ).toBe(true);
+    expect(report.result).toBe("not-ready");
+    expect(doctorExitCode(report)).toBe(1);
   });
 
   it("fails identity configuration for a misspelled public-signup value, never silently disabling or enabling it", async () => {