deploy: make the OTP-signup broker + route survive redeploys

[Alexgodoroja]

The signup broker (cmd/otpsignup-broker, added in #77) and its public nginx route were configured by hand on the broker VM. A broker redeploy regenerates broker.conf, which wiped the route — signup requests then fell through to the managed-key broker ({"error":"unknown app: didit"}).

This folds both into the managed deploy so redeploys and fresh VMs recreate them:

• startup.sh — builds cmd/otpsignup-broker and installs a systemd unit that runs only when broker-env metadata carries an OTPSIGNUP_* block (a broker VM that doesn't offer signup skips it). Every app/provider/host specific + secret comes from broker-env metadata; only a non-secret listen/DB default is in the unit.
• setup-broker-tls.sh — injects operator-provided nginx location blocks (from broker-extra-locations metadata) before location /, so the signup route survives every regeneration. No app-specific route is baked into the repo.

Secrets and app/host specifics live in instance metadata, not the repo. Validated on the live VM: regenerating broker.conf from scratch re-injects the route and the endpoint answers from the signup broker. Merging this triggers a redeploy that stands the whole thing up cleanly.

[TeoSlayer]

Security + quality review. Solid engineering with good test discipline, but one HIGH issue must be fixed before merge, plus a few MED items — and this branch is currently CONFLICTING (needs a rebase regardless).

HIGH — the anti-Sybil cap is trivially bypassable (X-Forwarded-For spoofing)

clientIP() in internal/otpsignup/broker.go trusts the first, client-supplied element of X-Forwarded-For, while the nginx vhost in deploy/setup-broker-tls.sh only appends the real address via $proxy_add_x_forwarded_for (never strips/replaces a forged header) and never sets X-Real-IP. Since a caller's "identity" is a free, self-generated ed25519 keypair (internal/broker/identity.go has no allowlist), anyone can spoof a fresh X-Forwarded-For per request and mint unlimited provider accounts — defeating MaxIdentitiesPerIP / MintCooldown, the only anti-farming control, and contradicting the guarantee stated in docs/BROKER-SIGNUP.md. TestPerIPCapBlocksSybil calls Broker.Signup() directly with a trusted ip, so the real HTTP-layer extraction has zero coverage.
Fix: derive the client IP from a trusted hop (set X-Real-IP in nginx and read that, or take the last XFF entry nginx appended), and add an HTTP-layer test that exercises clientIP().

MED

• Signup race (orphaned account): check-then-act with no per-caller lock — two concurrent /signup for the same new caller both run the full register→OTP→verify. INSERT OR IGNORE drops the loser's row, but its HTTP response still returns an {email,api_key} that store.get will never return again → a permanently orphaned real provider account.
• Partial signups aren't resumable: context-cancel after register() succeeds but before persist leaves an orphaned provider account; a retry mints a new one instead of resuming.
• SMTP DoS: the public :25 listener in internal/otpmail/server.go has no concurrent-connection cap / per-IP throttle; readData() reads up to the 2-min deadline regardless of MaxMsgBytes (slow-loris).
• Cleartext control-plane: broker→otpmail is plain HTTP with only a static bearer token; docs describe cross-host deploy, so the token + OTP can traverse the network in cleartext. Consider TLS/mTLS + token rotation.

LOW

• OTPSIGNUP_ENC_KEY silently falls back to an ephemeral key — a restart of a misconfigured deploy irrecoverably orphans all sealed creds; fail hard (or warn loudly) instead.
• otpsignup-data dir created without an explicit 0700.
• nginx patch writes a fixed /tmp/broker.conf.new (use mktemp).
• MintCooldown exists in Config but is never wired to an env var in cmd/otpsignup-broker/main.go, so the knob is unreachable.

What's good

No hardcoded secrets anywhere; parameterized queries (no SQLi); no shell injection in the deploy scripts (quoted heredocs/awk, no eval/curl|sh); TLS correctly enforced (https-only validation, no skip-verify); constant-time token compares; tightly-scoped manifest grants (key.sign target self, explicit deduped hosts, no wildcards, fs.write scoped to $APP/secrets.json); and strong test coverage otherwise (auth, idempotency, at-rest encryption vs raw ciphertext, signed-vs-unsigned, full SMTP round-trip, real go build of scaffolded code).

Please fix the XFF-derived client IP (+ test) and the signup race at minimum, and rebase — then this is close.