Add a config toggle to turn off new user registration

APP_ALLOW_REGISTRATION (default true) gates the only "sign up" this app has --
the account-creation side effect of POST /api/auth/magic-link. When false, an
unknown address is silently ignored (find-only, no findOrCreateByEmail) while
an existing address still gets its sign-in link as normal; the response is
identical either way (202, same message), so there's still no enumeration
signal.

- Config::allowRegistration, read from APP_ALLOW_REGISTRATION.
- AuthController::requestLoginLink takes the flag; only looks up (doesn't
  create) when it's off.
- docker-compose.yml / .env.example / README document the new var.
- ApiTestCase::reconfigure() rebuilds the app against changed env (same
  database) for tests that need a non-default Config; two new AuthTest
  cases cover both halves (blocks a new address, doesn't block an existing
  one). 59 tests pass.

Verified against the rebuilt container: with the flag on (default), a new
address gets a link and an account; switched off via the same env var, a
brand-new address gets the same 202 but no email and no user row, while an
address that already had an account still receives its link.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -19,6 +19,11 @@ JWT_SECRET=
 # How long an issued token stays valid, in seconds (default: 86400 = 24h).
 JWT_TTL=86400
 
+# When false, POST /api/auth/magic-link only signs existing users in -- an
+# unknown address is silently ignored (same response either way) rather than
+# creating a new account. Closes sign-ups without touching existing users.
+APP_ALLOW_REGISTRATION=true
+
 # Base URL the app is reached at. Verification magic links point here, e.g.
 # <APP_URL>/verify-email?token=... The Docker image serves the SPA and the API
 # together on http://localhost:8080; a host `npm run dev` serves it on :5173.