feat: single-billing edge path for MCP + open public signup

- Public signup no longer requires a caller bearer (POST /auth/signup)
- create_user remains admin-only (POST /auth/users)
- Optional VERAE_MCP_EDGE_URL bills global stamps via zap.verae.ai
- Clearer public auth errors and instructions for Grok/clients

cmd/verae-mcp-timestamping-server/main.go

@@ -10,6 +10,7 @@ import (
 	"os/signal"
 	"syscall"
 
+	"git.georgelambert.org/marchon/verae-mcp-timestamping-server-go/internal/edgebill"
 	"git.georgelambert.org/marchon/verae-mcp-timestamping-server-go/internal/embednats"
 	"git.georgelambert.org/marchon/verae-mcp-timestamping-server-go/internal/ledger"
 	"git.georgelambert.org/marchon/verae-mcp-timestamping-server-go/internal/server"
@@ -32,6 +33,10 @@ func main() {
 	}
 	global := veraetime.NewClient(cfg.GlobalURL, veraetime.WithAuthPath(cfg.AuthPath))
 	keeper := veraetime.NewKeeper(global, cfg.AuthPath)
+	edge := edgebill.FromEnv()
+	if edge != nil {
+		log.Printf("MCP global stamps bill via edge %s (channel=%s)", edge.BaseURL, edge.Channel)
+	}
 
 	emb, err := embednats.Start(embednats.Options{
 		Listen:        cfg.NATSListen,
@@ -54,6 +59,7 @@ func main() {
 			Ledger:        led,
 			Global:        global,
 			Keeper:        keeper,
+			Edge:          edge,
 			AuthPath:      cfg.AuthPath,
 			GlobalURL:     cfg.GlobalURL,
 			RequireBearer: cfg.RequireBearer,
@@ -82,6 +88,7 @@ func main() {
 			Ledger:        led,
 			Global:        global,
 			Keeper:        keeper,
+			Edge:          edge,
 			RequireBearer: cfg.RequireBearer,
 		})
 		ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)