feat: disable user registration via DISABLE_REGISTRATION env var

- Add DISABLE_REGISTRATION setting (default False) in app/config.py
- Return 403 when registration is disabled in POST /auth/register
- Add test_register_disabled test

app/config.py

@@ -33,6 +33,7 @@ class Settings(BaseSettings):
     LOG_LEVEL: str = "INFO"
     INITIAL_ADMIN_USERNAME: str  # Required: admin user to auto-create
     INITIAL_ADMIN_PASSWORD: str  # Required: password for auto-created admin
+    DISABLE_REGISTRATION: bool = False
 
     @property
     def resolved_database_url(self) -> str: