Validate invite codes on /auth/signup with closed registrations

The closed-registration check added in 5996c93 only requires invite_code
to be non-empty -- the code itself is never validated. Because
signupWithRegistration() creates and commits the user before calling
CreateInvitedUser(), and usersinvited.invite_id carries no foreign key,
posting an arbitrary string as invite_code creates a full account on an
instance that has registrations closed:

curl -d 'alias=x&pass=y&invite_code=z' https://example.com/auth/signup

Look the invite up and confirm it's still active before continuing, the
same way viewOauthCallback() already does for OAuth registrations. An
empty code matches no rows, so signups without an invite are still
refused exactly as before.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>