Fix sign-in page to show Sign Up link only when sign-up is enabled

docs/plans/2026-08-19-allow-signup-env.md

@@ -13,7 +13,7 @@
 - Modify: `main.go` — read env var, set `AllowSignup` on the `AuthHandler`.
 - Modify: `handler/auth.go` — replace count-based gating with the `AllowSignup` flag.
 - No changes to `store/store.go` (`UserCount` is left in place).
-- No changes to templates (the `HasUser` key drives the nav link already).
+- Modify: `template/signin.html` — render the "Sign Up" nav link with `{{if .AllowSignup}}`.
 
 ---
 
@@ -77,9 +77,19 @@ func (h *AuthHandler) allowSignup() bool {
 }
 ```
 
-- [ ] **Step 3: Update the three `HasUser` template renders to use `allowSignup()`**
+- [ ] **Step 3: Update the three `AllowSignup` template renders to use `allowSignup()`**
 
-Replace every occurrence of `"HasUser": h.hasUsers()` with `"HasUser": h.allowSignup()`. There are three (the initial GET render and the two error paths in the POST handler).
+Replace every occurrence of `"AllowSignup": h.allowSignup()` where it was passed as the `HasUser` key. In the three render calls in the sign-in handler, ensure the map key is `AllowSignup`:
+
+```go
+map[string]any{"AllowSignup": h.allowSignup()}
+map[string]any{"Error": "Invalid email or password.", "AllowSignup": h.allowSignup()}
+map[string]any{"Error": "Invalid email or password.", "AllowSignup": h.allowSignup()}
+```
+
+- [ ] **Step 3b: Update the sign-in template to use `AllowSignup` without inversion**
+
+In `template/signin.html`, the nav-link conditional must render the link when sign-up is allowed. Replace `{{if not .HasUser}}` with `{{if .AllowSignup}}`. (Retain the `{{end}}`.)
 
 - [ ] **Step 4: Commit**