Accounts with limits: a Newznab key and a tier per user, daily API and NZB counts, invites

ACCESS=accounts (config/access.ts; open stays the default and behaves as
before): Newznab and the catalog's releases routes name a user (apikey or
the web interface's token), whose tier sets searches and NZBs per UTC day
(Newznab 500/501, the catalog 429) and how far back they see (102/403).
Counted in one upsert per use, so the last one can't be taken twice;
caps, stats and refused requests aren't counted. Signup takes an invite
(SIGNUP), which may give a tier; ace access:invite, access:tier (extends a
running tier), access:suspend. The web interface signs in and shows the
day's usage and the Newznab key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

start/env.ts

@@ -52,6 +52,10 @@ export default await Env.create(new URL('../', import.meta.url), {
   // Newznab API key (empty: no key needed)
   NEWZNAB_API_KEY: Env.schema.secret.optional(),
 
+  // Access (config/access.ts): open (one key, no limits) or accounts (a key per user, tiers with daily limits)
+  ACCESS: Env.schema.enum.optional(['open', 'accounts'] as const),
+  SIGNUP: Env.schema.enum.optional(['open', 'invite', 'closed'] as const),
+
   // Coordinator
   RANGE_ARTICLES: Env.schema.number.optional(),
   TAIL_EVERY_SECONDS: Env.schema.number.optional(),