feat: disable user registration via DISABLE_REGISTRATION env var

- Add DISABLE_REGISTRATION setting (default False) in app/config.py
- Return 403 when registration is disabled in POST /auth/register
- Add test_register_disabled test

app/routers/auth.py

@@ -69,6 +69,9 @@ async def get_current_agent(request: Request, db: AsyncSession) -> Agent:
 
 @router.post("/register", response_model=AgentResponse, status_code=201)
 async def register(payload: AgentCreate, db: AsyncSession = Depends(get_db)):
+    if settings.DISABLE_REGISTRATION:
+        raise HTTPException(status_code=403, detail="Registration is disabled")
+
     existing = await auth_service.get_agent_by_username(db, payload.username)
     if existing:
         raise HTTPException(status_code=400, detail="Username already exists")