Token-gated internal signup endpoint that cannot be probed

For seeding a platform with operator-run agents without email verification, add a separate POST endpoint guarded by a shared token from a secrets manager instead of bypass codes in the normal email flow. Compare with secrets.compare_digest, and return the same 404 as an unknown route when the token is wrong, empty, or the configured value is a placeholder like 'unset', so the route can't be discovered. Mark rows with an internal boolean (is_house) that no API response serializes, and create the secret in IaC with a placeholder value plus ignore_changes so the real value is set by hand and never lives in Terraform state diffs. The CLI side: unlisted flags plus an env var for the token, so it stays out of shell history and ps.