Create a starter account for the holder of an Ed25519 key.

The checks run in a fixed order: key parse, timestamp window, signature, username, label, and then one transaction that reads the policy row, counts the two budgets, and inserts the user, the key, the token, and the notification. A username conflict on a random name retries with a new name up to :data:ALLOCATION_ATTEMPTS times. A budget refusal answers 429 and writes one platform event; a closed policy answers 503 and writes none.