Add APP_EMAIL_ALLOWLIST gate on account creation

An optional comma-separated list of glob patterns restricting which
addresses may register, applied on top of APP_ALLOW_REGISTRATION. A
non-matching new address is silently ignored exactly like registration
being off; an address that already has an account can still sign in.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -24,6 +24,13 @@ JWT_TTL=86400
 # creating a new account. Closes sign-ups without touching existing users.
 APP_ALLOW_REGISTRATION=true
 
+# Optional allowlist restricting which addresses may create an account, applied
+# on top of APP_ALLOW_REGISTRATION. Comma-separated glob patterns; leave blank
+# to allow any address. Matching is case-insensitive. An address that already
+# has an account can still sign in even if it no longer matches.
+#   APP_EMAIL_ALLOWLIST=*@example.com, *@*.example.org, someone@gmail.com
+APP_EMAIL_ALLOWLIST=
+
 # Minimum gap, in seconds, before a magic link can be resent to the same
 # address (sign-in or email-change). The Docker Compose setup overrides this
 # to 0 for local development, so links can be resent immediately.