fix: close hosted signups and point the readme at self-hosting

[FrkAk]

Summary

The hosted version at app.piyaz.ai is shutting down, so this closes new signups on the hosted production deploy and makes the README describe self-hosting only.

• deploy:cf and preview:cf no longer pass SIGNUPS_ENABLED=true, so the production build bakes signups off and signupsDisabled() serves the invite-only page and rejects /sign-up/email. Existing accounts keep signing in.
• Self-host is unchanged: signupsDisabled() only closes signup when DEPLOY_TARGET=cloudflare, so self-hosted builds stay open (covered by the existing "signup open on self-host" test). deploy:cf:dev keeps the opt-in.
• README drops the "Hosted (beta)" section and the hosted MCP endpoint, which now reads <your-instance>/api/mcp.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation

Testing

• Tested locally with bun run dev
• Linting passes (bun run lint)
• Typecheck passes (bun run typecheck)
• Workers smoke passes (bun run build:cf && bun run smoke:cf) — required when this PR touches app/api/**, middleware.ts, worker-cf.ts, or a .node.ts / .workers.ts pair

tests/config/env.test.ts now pins that the production scripts omit the opt-in and the dev script keeps it.

Notes for reviewer

Takes effect on the next release deploy. The sign-up page copy still reads "Invite only for now". Plugin MCP configs, server.json, the get-started modal and the legal pages still point at app.piyaz.ai; flagged for a follow-up.

Docs impact

• docs.piyaz.ai still describes the hosted version; it lives in the piyaz-docs repo and needs its own change.

Compliance impact

• none