Enforce signup checks consistently across all registration paths

Previously, registration eligibility (closed registration, invite
validity, and password-auth availability) was checked inconsistently
depending on the endpoint, including /api/auth/signup, /oauth/signup,
and instances with password auth disabled.

Funnels all paths (web, API, OAuth) through a single canRegister() gate so
the checks can't be bypassed by picking a different endpoint, and includes
the invite code in the OAuth signature. Extends the invite validation from
#1724 to the API and OAuth paths it didn't cover. Also adds regression
tests covering each path.