Add a config toggle to turn off new user registration

APP_ALLOW_REGISTRATION (default true) gates the only "sign up" this app has --
the account-creation side effect of POST /api/auth/magic-link. When false, an
unknown address is silently ignored (find-only, no findOrCreateByEmail) while
an existing address still gets its sign-in link as normal; the response is
identical either way (202, same message), so there's still no enumeration
signal.

- Config::allowRegistration, read from APP_ALLOW_REGISTRATION.
- AuthController::requestLoginLink takes the flag; only looks up (doesn't
  create) when it's off.
- docker-compose.yml / .env.example / README document the new var.
- ApiTestCase::reconfigure() rebuilds the app against changed env (same
  database) for tests that need a non-default Config; two new AuthTest
  cases cover both halves (blocks a new address, doesn't block an existing
  one). 59 tests pass.

Verified against the rebuilt container: with the flag on (default), a new
address gets a link and an account; switched off via the same env var, a
brand-new address gets the same 202 but no email and no user row, while an
address that already had an account still receives its link.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/AuthTest.php

@@ -79,4 +79,32 @@ final class AuthTest extends ApiTestCase
         self::assertSame(200, $response->getStatusCode());
         self::assertSame('linus@example.com', $this->decode($response)['user']['email']);
     }
+
+    public function test_registration_can_be_turned_off_for_a_new_address(): void
+    {
+        $this->reconfigure(['APP_ALLOW_REGISTRATION' => 'false']);
+
+        $response = $this->request('POST', '/api/auth/magic-link', ['email' => 'nobody@example.com']);
+
+        // Same response either way -- no enumeration signal.
+        self::assertSame(202, $response->getStatusCode());
+        self::assertSame([], $this->sentEmails());
+        self::assertSame(0, (int) $this->db()->query('SELECT COUNT(*) FROM users')->fetchColumn());
+    }
+
+    public function test_turning_off_registration_does_not_block_an_existing_user(): void
+    {
+        // Sign up while registration is still open.
+        $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
+        $this->request('POST', '/api/auth/verify-email', ['token' => $this->tokenFromEmail()]);
+        $this->db()->prepare('UPDATE users SET verification_email_sent_at = NULL WHERE email = :e')
+            ->execute(['e' => 'ada@example.com']);
+
+        $this->reconfigure(['APP_ALLOW_REGISTRATION' => 'false']);
+
+        $response = $this->request('POST', '/api/auth/magic-link', ['email' => 'ada@example.com']);
+
+        self::assertSame(202, $response->getStatusCode());
+        self::assertSame('ada@example.com', $this->lastEmail()['to']);
+    }
 }