The $users create permission check used the standard rule resolution path, which falls through to $default rules before reaching the $users fallback. Apps with $default deny-all rules (common pattern) had guest auth and other signup flows rejected because the $default rule was evaluated instead of the intended $users create fallback.

Tests
Added tests for $default and the extraFields-without-rule behavior. Also updated extraFields tests to set a create rule since they now require one.

Backend changes
Changed assert-create-permission! to only check the explicit $users.allow.create rule, skipping $default paths entirely. New default user auth logic is:

• Explicit create rule exists: evaluate it
• No rule but extraFields supplied: false (prevents unvalidated writes)
• No rule, no extraFields: true

Docs/rules
Added a note in the users doc and instant-rules about extraFields requiring an explicit create rule.