nx_signup_origin_gate.nx

nx_signup_origin_gate.nx -- proves POST /register is gated on LAN-AND-INVITED, not on a global flag. WHY (debt 1785445694): public registration was open to the internet because /register consulted ONE global boolean. nx_lan_signup.ls_signup_allowed (LAN AND invited) existed and was gate-proven, but was NOT WIRED to the route. This gate proves the wiring, which is the half that was missing. EVERY TOOTH IS A DENIAL. No tooth registers an account: the ALLOW path is deliberately untested here because exercising it would create a real credential. The ALLOW semantics are already proven 17/17 by nx_lan_signup_gate; what this file adds is that the ROUTE actually consults that decision. T4 IS THE NON-VACUITY TOOTH and the reason this gate is worth anything: with the flag CLOSED the route must answer "registration closed". That proves T1-T3's 403s come from the NEW origin/invite checks and are not just the old flag firing -- without it, a permanently-shut flag would make T1-T3 pass for the wrong reason, which is exactly the vacuous-green class. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0