Harden public signup against enumeration and abuse

Rate limit public signups to 500 per IP per minute and return generic failure messages to prevent email enumeration.