Signup queueing

[dholms]

Adds signup queueing to the entryway.

• Entryway keep track of the number of activated accounts within a given time period
• If a new signup exceeds its configured limit then that user's account is created, but it is flagged as "deactivated"
• That user is given a valid refresh token, but their access token has a com.atproto.deactivated scope that only allows them to hit a select few endpoints (including a new endpoint that allows them to check their location in the queue)
• Accounts over the activation limit are activated in FIFO order. The app instance that holds the leader lock will poll every 30 seconds for deactivated accounts that are under the activation limit. It will then activate those accounts.
• After activation, a user can refresh their session to get a valid full-scope access token

Followup that adds notification of account activation: #2115