The first account can only be made in a 30-minute setup window

Family idea #5105, practice 8 (Scribe #5113), the operator's choice of
setup window over a setup code.

Before this, whoever reached /register first on an empty server became
its admin. On a fresh server at a public address, that could be a
stranger, and a new DNS name is found within minutes.

Now the first registration is refused once 30 minutes have passed since
the server started (create_app records STARTED_AT). A restart opens the
window again. It is a constant rather than a Setting, because there is no
admin yet to change one. Once an account exists it no longer matters, so
existing servers are unaffected. public-hosting.md says so, and two
integration tests cover both sides.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/public-hosting.md

@@ -14,6 +14,12 @@ itself: the first account created becomes the admin *and* closes registration be
 it, so there is no window between "my account exists" and "I remembered to turn it
 off". A brand-new instance is never locked out of itself, and never left open either.
 
+**The first account has to be made within 30 minutes of the server starting.** After
+that, `/register` refuses the first account. Otherwise a fresh server on a public
+address would belong to whoever found it first. If you miss the window, restart the
+container and register straight away. Once an account exists, the window no longer
+matters.
+
 **Instances that predate this still need one manual flip.** The close fires when the
 first account is created, so a server whose admin already existed keeps whatever
 `allow_registration` was set to — which was **on** by default. Check **Settings →