Setup and invitations: the first login made from the client, everyone else by a group's invitation

PrivaPub's sign-up is closed. While it has no administrator, Login offers /setup, where the first login is made with its
first persona and becomes the administrator (PrivaPub's /clientapi/user/setup; owner decision 2026-10-16: first come,
first served, and setup then closes for good). Everyone else joins at /join?code=: a group's invitation makes the login,
and its first persona joins the group (/clientapi/user/invitation/signup). Login links there, and a group's page shows
the link next to its code. A login without a persona is sent from Login to Settings instead of a dead end. Login, setup
and join share AuthService's StartSession, and all three go without credentials.

e2e (Login/SignUpTests, against the pasture): setup offered on Login, made, the feed reached with Administration, then a
signed-out reader is offered sign-in and invitations only; an invitation link makes a login whose persona joins the
circle. The phone sweep covers /setup and /join: login, setup and join fit every portrait phone, and AccountTests signs
in through the changed Login. The town's signed-in tests were not rerun: today's pasture came up without Mastodon, and
its town seed left stale sessions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -296,6 +296,14 @@ supplies:
   each persona the client uses gets its own Mastodon token in exchange for the JWT (PrivaPub's `PersonaExchange`,
   RFC 8693 on `/oauth/token`, first-party client id `AppConfiguration:ClientId`). `AuthData` keeps the JWT and the
   persona tokens; logout revokes every persona token, then forgets the session and IndexedDB.
+- **The ways in** (sign-up is closed on PrivaPub; owner decision 2026-10-16):
+  - **Setup** (`Pages/Setup.razor` at `/setup`): while PrivaPub has no administrator (`/clientapi/user/setup`), the first
+    login is made there, first come, first served, with its first persona. It becomes the administrator, and setup
+    closes for good. Login offers it while it waits.
+  - **Invitations** (`Pages/Join.razor` at `/join?code=`): a group's invitation makes a login whose first persona joins
+    the group (`/clientapi/user/invitation/signup`). Login links there, and a group's page shows the link with its code.
+  - Both sign in at once like Login (`AuthService.SetUp` / `Join`, sent with no credentials). A login without a
+    persona is sent from Login to Settings to make one.
 - **Services** (`Services/`): `TimelineService` (every feed as `FeedPage`s of `FeedPost`s, paged by `max_id`/`min_id`;
   circles are read as ids from `/clientapi` and hydrated through `/api/v1/statuses?id[]=`; located posts come from
   `/clientapi/post/nearby` and have no Mastodon actions), `StatusService` (publish, favourite, boost, bookmark, delete,