Extend Castle integration across the full user lifecycle

[bartes]

What & why

The app already scored login (risk/filter), and logged logout and profile updates. This extends Castle coverage to the rest of the user lifecycle so the example mirrors a real end-to-end integration, and makes sure every Castle-bound form carries a request token minted in the browser by castle.js.

Changes

• Sign up is now risk-assessed ($registration → risk). A deny verdict rolls the registration back (mirroring the login flow); invalid attempts are reported to filter.
• Custom event ($custom) is available from the profile page, once signed in.
• Request tokens everywhere — the sign-up, profile-update, custom-event and logout forms all mint and forward a castle_request_token. Logout becomes a small button_to form so it too can mint a token.
• Home page copy and readme updated to describe the fuller lifecycle.
• RSpec coverage for the new registration, custom-event and token-carrying paths.

Known limitations

• There is no dedicated password-reset flow: Devise :recoverable is not enabled in this demo, so the existing "edit password" screen is left as-is rather than instrumented as a Castle $password_reset event.
• Custom and logout events use the non-blocking log endpoint, so they are fire-and-forget and not verdict-driven.