- Add DISABLE_REGISTRATION setting (default False) in app/config.py - Return 403 when registration is disabled in POST /auth/register - Add test_register_disabled test
- Auth: register, login, JWT with refresh tokens, blocklist - Projects/Folders/Documents CRUD with soft deletes - Tags CRUD and assignment - FTS5 search with highlights and tag filtering - ADR-001, ADR-002, ADR-003 compliant - Security fixes applied (JWT_SECRET_KEY, exception handler, cookie secure) - 25 tests passing