Bound icon picks per person, and keep people's Signals apart (#340 #343)

#340: POST /api/signals/icon spends the server's TYPESAFE_KEY for
anyone signed in, whatever signals_on_server says, and is not tied to
a Signal, so a loop on it ran up the bill and, through the shared pace
and a 429's back-off, held back everyone's judging. Each person now has
20 picks an hour; past that it is a 429 the page shows as a toast.

#343: on the server's key, calls() put everyone's Signals on an item in
one call (#275), so one person's free-text description was part of the
question that decided another's verdicts. Each person's Signals on an
item are now a call of their own. The saving #275 made is lost only
where two people have Signals on the same item.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/signals.md

@@ -92,8 +92,8 @@ The recent half reads the index `entries_recent`, on each feed's items by date,
 is asked by; without it each wake read all of `entries`, 605 MB, 566 ms to find nothing (#274).
 
 Rows for one item and one person are grouped, so an item is one call whatever the number of
-Signals. On the server's key, everyone's Signals on the same item go in one call too, its text
-sent once (#275). Up to ten calls are in flight at once (`IN_FLIGHT`): one at a time, about 150 ms
+Signals. Two people's Signals never share a call, even on the server's key, where they did until
+#343: one person's description was then in the question that decided the other's verdicts. Up to ten calls are in flight at once (`IN_FLIGHT`): one at a time, about 150 ms
 each, a month of items took twenty minutes. Every call to Jev, Signals', icons' and key checks',
 takes a turn (`pace`, #277): TypeSafe's default limits are 80 requests and 100,000 input tokens a
 second, and ipx keeps to 60 and 80,000, each call holding the line for a 60th of a second or its