Add APP_EMAIL_ALLOWLIST gate on account creation

An optional comma-separated list of glob patterns restricting which
addresses may register, applied on top of APP_ALLOW_REGISTRATION. A
non-matching new address is silently ignored exactly like registration
being off; an address that already has an account can still sign in.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -17,6 +17,9 @@ services:
       # Set to false to stop new accounts being created (existing users can
       # still sign in).
       APP_ALLOW_REGISTRATION: "${APP_ALLOW_REGISTRATION:-true}"
+      # Optional comma-separated glob allowlist for addresses that may register,
+      # e.g. "*@example.com, *@*.example.org". Blank means any address.
+      APP_EMAIL_ALLOWLIST: "${APP_EMAIL_ALLOWLIST:-}"
       # 0 here (unlike the app's own default of 60) so magic links can be
       # resent immediately while developing -- override if that gets in the way.
       MAGIC_LINK_RESEND_SECONDS: "${MAGIC_LINK_RESEND_SECONDS:-0}"