nx_lan_signup_daemon.nx

nx_lan_signup_daemon.nx -- the FAMILY SIGNUP + HR ADMIN surface, served (by the Nishi Publisher) ONLY to the LAN. SEPARATE & additive: it does NOT touch the live public login daemon (whose registration stays CLOSED). Thin main over the shared router nx_lan_signup_routes (lsd_route) -- the routes + gating are documented there; the socket referee (nx_lan_signup_socket_gate) drives the SAME lsd_route over a real loopback socket (rule #15 DRY). Routes (each LAN-gated by the real accept() peer IP, never a spoofable header): POST /register -> ls_signup_allowed (LAN AND invited) -> OPAQUE register -> hra_claim ; else 403 GET /hr -> owner-gated roster console (hap_emit) ; non-owner/non-LAN -> stub POST /hr/invite -> owner-only: hra_invite ; POST /hr/suspend -> owner-only: hra_suspend Run with the SAME server-keys path + realm (nishi_site_admin) as the hub /login daemon so session tokens validate. argv: [1]=port [2]=keys [3]=opaque-store [4]=budget [5]=hr-store [6]=realm(opt, default nishi_site_admin) [7]=argon2_m(opt) One binary serves every property: run with [6]=andelinwest_admin + andelinwest's own keys + andelinwest_hr.log.