Wires LicenseEnforcer into UserAdminController.createUser and OidcAuthController auto-signup. Cap fires before any validation so over-cap creates short-circuit cheaply. Audit emission already present (LicenseEnforcer 3-arg ctor from T16 emits cap_exceeded under AuditCategory.LICENSE). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>