Return a descriptive error message with the sign-up URL instead of a bare 403

A real HTTP redirect doesn't make sense for a JSON API client -- most either
ignore a 3xx or follow it into an HTML page where they expected JSON, which
is worse than a clean failure. Returning error text that includes the web
sign-up URL is what actually reaches a human, since most Mastodon apps
surface that string on-screen when a request fails.

zz_altcha.rb

@@ -210,8 +210,14 @@ Rails.application.config.to_prepare do
 
       private
 
+      # Not a real HTTP redirect -- these are JSON API clients (app
+      # backends), not browsers, so a 3xx + Location header either gets
+      # silently ignored or blindly followed into an HTML page where the
+      # app expected JSON, which is worse than just failing. A descriptive
+      # `error` message is what actually reaches a human: most Mastodon
+      # apps surface that string on-screen when a request fails.
       def block_api_account_creation
-        forbidden
+        render json: { error: "Account creation via the API is disabled on this server. Please sign up at #{new_user_registration_url}." }, status: 403
       end
     end
   end