v0.281.0: 'Done' asks the probe first; sign-up closed after the first admin (decision 47); R-713 code-bound values refused, ${NAME|base64}

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/metadata.go

@@ -60,8 +60,11 @@ type Metadata struct {
 	// app's first setup is done — for an app whose first visitor creates the admin. See setup_gate.go.
 	SetupGate bool `yaml:"setup_gate,omitempty" json:"setup_gate,omitempty"`
 	// SetupDoneProbe (v0.280.0) is the app's own read-only "an admin exists" status; absent = the household's button.
-	SetupDoneProbe *SetupDoneProbe  `yaml:"setup_done_probe,omitempty" json:"setup_done_probe,omitempty"`
-	Integrations   []IntegrationDef `yaml:"integrations,omitempty" json:"integrations,omitempty"`
+	SetupDoneProbe *SetupDoneProbe `yaml:"setup_done_probe,omitempty" json:"setup_done_probe,omitempty"`
+	// SignupBlock (v0.281.0, `09` §3 decision 47): a traefik matcher for the app's own sign-up address, closed once the
+	// setup gate opens. See signup_block.go.
+	SignupBlock  string           `yaml:"signup_block,omitempty" json:"signup_block,omitempty"`
+	Integrations []IntegrationDef `yaml:"integrations,omitempty" json:"integrations,omitempty"`
 	// InitialCreds: for apps that auto-generate a first-login credential into a file inside the
 	// container (e.g. Crafty's default-creds.txt). The controller reads + parses that file live and
 	// surfaces it on the app page, so the customer never has to dig through logs. Optional.
@@ -146,6 +149,8 @@ type AppInfo struct {
 	Prerequisites []string `yaml:"prerequisites" json:"prerequisites"`
 	DefaultCreds  string   `yaml:"default_creds" json:"default_creds"`
 	DocsURL       string   `yaml:"docs_url" json:"docs_url"`
+	// AddPeople (v0.281.0, decision 47): how the household adds a family member once sign-up is closed.
+	AddPeople string `yaml:"add_people,omitempty" json:"add_people,omitempty"`
 }
 
 // OptionalConfigGroup defines a group of optional config fields (e.g., "Metadata providers").