feat: disable user registration via DISABLE_REGISTRATION env var

- Add DISABLE_REGISTRATION setting (default False) in app/config.py
- Return 403 when registration is disabled in POST /auth/register
- Add test_register_disabled test

tests/test_auth.py

@@ -68,3 +68,16 @@ async def test_me(client):
 async def test_me_unauthorized(client):
     response = await client.get("/api/v1/auth/me")
     assert response.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_register_disabled(client, monkeypatch):
+    from app.config import settings
+    monkeypatch.setattr(settings, "DISABLE_REGISTRATION", True)
+
+    response = await client.post(
+        "/api/v1/auth/register",
+        json={"username": "shouldfail", "password": "testpass123"}
+    )
+    assert response.status_code == 403
+    assert response.json()["detail"] == "Registration is disabled"