feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docs/auth/signup.md

@@ -1,3 +1,8 @@
 # signup
 
-TODO: Complete documentation.
+Self-service signup uses `POST /api/auth/register` and the `/register` frontend route. It is disabled
+unless `Auth:AllowRegistration`/`AUTH_ALLOW_REGISTRATION` is enabled. When Cloudflare Turnstile keys
+are configured, the server validates the widget token through Siteverify before creating the account.
+
+Production activation is intentionally blocked until the operator supplies Turnstile configuration;
+see `BLOCKERS.md`. Email verification can also be required before the first login.