feat: put the access codes behind a feature flag

.env.test

@@ -3,3 +3,7 @@ KERNEL_CLASS='App\Kernel'
 # Fixed and committed so the test suite is reproducible, and never served: .env.test is excluded
 # from the deploy rsync and production takes APP_SECRET from its own uncommitted .env.local.
 APP_SECRET='$ecretf0rt3st'
+
+# The access-code suite tests the feature, not the gate in front of it, so it runs with the flag
+# on.
+FEATURE_ACCESS_CODES=true