Signup runs on the public auth host. Tenant access begins after email confirmation and tenant bootstrap.