Signing up never makes a master.

A user created with no tenant has no site, which makes them a master. The actions this runs on (:register_with_password and :create) refuse that to everyone, a master included: a new master is added by a master from the admin dashboard's Users table, which runs :master_create and its own master-only checks.

A creation with a tenant makes a user of that site and passes, which is how a site takes registrations. A call made with authorize?: false passes too: that is how the installer makes the first master, before any master exists to ask.

Each refusal is announced on cms_core:user:master_creation_refused with %{action: action_name, actor_id: id | nil, email: email}.

Add it to every action that can create a user with no tenant, other than :master_create:

validate MishkaCmsCore.Accounts.Validations.MasterUserCreation, before_action?: true