Signup Bridge

Email/password sign-up is routed through /api/partner-signup so the raw Better Auth sign-up endpoint stays gated.

• Local development uses a built-in partner bridge secret.
• Production should set PARTNER_SIGNUP_BRIDGE_SECRET on the partners app and Convex deployment.
• ADMIN_SIGNUP_BRIDGE_SECRET is accepted only as a fallback for shared local/bootstrap environments.