Add a config toggle to turn off new user registration

APP_ALLOW_REGISTRATION (default true) gates the only "sign up" this app has --
the account-creation side effect of POST /api/auth/magic-link. When false, an
unknown address is silently ignored (find-only, no findOrCreateByEmail) while
an existing address still gets its sign-in link as normal; the response is
identical either way (202, same message), so there's still no enumeration
signal.

- Config::allowRegistration, read from APP_ALLOW_REGISTRATION.
- AuthController::requestLoginLink takes the flag; only looks up (doesn't
  create) when it's off.
- docker-compose.yml / .env.example / README document the new var.
- ApiTestCase::reconfigure() rebuilds the app against changed env (same
  database) for tests that need a non-default Config; two new AuthTest
  cases cover both halves (blocks a new address, doesn't block an existing
  one). 59 tests pass.

Verified against the rebuilt container: with the flag on (default), a new
address gets a link and an account; switched off via the same env var, a
brand-new address gets the same 202 but no email and no user row, while an
address that already had an account still receives its link.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/Http/Controllers/AuthController.php

@@ -25,6 +25,7 @@ final class AuthController extends Controller
         private readonly UserRepository $users,
         private readonly SessionPayload $session,
         private readonly EmailVerifier $verifier,
+        private readonly bool $allowRegistration,
     ) {
     }
 
@@ -32,10 +33,13 @@ final class AuthController extends Controller
      * POST /api/auth/magic-link  (public)
      *
      * Emails a one-time sign-in link for the given address, creating the
-     * account first if it doesn't exist yet. Always responds the same way; a
-     * link is only actually (re-)sent when one hasn't gone out in the last
-     * minute. Opening the link creates the session and, the first time, marks
-     * the address verified.
+     * account first if it doesn't exist yet -- unless registration is turned
+     * off (APP_ALLOW_REGISTRATION=false), in which case an unknown address is
+     * silently ignored and only existing users can still sign in. Always
+     * responds the same way either way, so registered addresses can't be
+     * enumerated. A link is only actually (re-)sent when one hasn't gone out
+     * in the last minute. Opening the link creates the session and, the first
+     * time, marks the address verified.
      */
     public function requestLoginLink(Request $request, Response $response): Response
     {
@@ -46,9 +50,11 @@ final class AuthController extends Controller
             throw new ValidationException(['email' => ['Enter a valid email address.']]);
         }
 
-        $user = $this->users->findOrCreateByEmail($email);
+        $user = $this->allowRegistration
+            ? $this->users->findOrCreateByEmail($email)
+            : $this->users->findByEmail($email);
 
-        if (!$this->recentlyEmailed($user)) {
+        if ($user !== null && !$this->recentlyEmailed($user)) {
             try {
                 $this->verifier->sendLoginLink($user);
             } catch (MailException $e) {

src/Support/Config.php

@@ -15,6 +15,8 @@ final class Config
         public readonly string $jwtSecret,
         public readonly int $jwtTtl,
         public readonly bool $displayErrors,
+        /** When false, POST /auth/magic-link only signs existing users in -- it never creates a new account. */
+        public readonly bool $allowRegistration,
         /** Base URL of the frontend, used to build magic links. */
         public readonly string $appUrl,
         public readonly MailConfig $mail,
@@ -40,6 +42,7 @@ final class Config
         $jwtSecret = self::env('JWT_SECRET') ?? self::resolveSecret($storagePath . '/secret.key');
         $jwtTtl = (int) (self::env('JWT_TTL') ?? '86400');
         $displayErrors = filter_var(self::env('APP_DEBUG', 'false'), FILTER_VALIDATE_BOOL);
+        $allowRegistration = filter_var(self::env('APP_ALLOW_REGISTRATION', 'true'), FILTER_VALIDATE_BOOL);
 
         $appUrl = rtrim(self::env('APP_URL', 'http://localhost:5173'), '/');
 
@@ -60,7 +63,7 @@ final class Config
             smtpEncryption: strtolower(self::env('MAIL_SMTP_ENCRYPTION', 'tls')),
         );
 
-        return new self($databasePath, $jwtSecret, $jwtTtl, $displayErrors, $appUrl, $mail);
+        return new self($databasePath, $jwtSecret, $jwtTtl, $displayErrors, $allowRegistration, $appUrl, $mail);
     }
 
     private static function env(string $key, ?string $default = null): ?string

src/bootstrap.php

@@ -56,7 +56,7 @@ $mailer = $config->mail->transport === 'log'
     : new PhpMailerMailer($config->mail);
 $verifier = new EmailVerifier($verificationTokens, $users, $mailer, $config->appUrl);
 
-$authController = new AuthController($users, $session, $verifier);
+$authController = new AuthController($users, $session, $verifier, $config->allowRegistration);
 $emailController = new EmailVerificationController($users, $verificationTokens, $verifier, $session);
 $projectController = new ProjectController($projects, $cardStatuses);
 $cardController = new CardController($projects, $cards, $cardStatuses);