Make self-service signup opt-in via SIGNUP_ENABLED

/users/signup answers 403 unless SIGNUP_ENABLED is set. A public
GET /utils/config/ tells the login page, which hides the sign-up link,
and the signup page explains that an administrator creates accounts.

.env.example

@@ -63,5 +63,9 @@ DOCKER_IMAGE_FRONTEND=fluksio-frontend
 # The MCP endpoint agents connect to, and the OAuth server behind it.
 MCP_ENABLED=true
 
+# Self-service accounts from the login page. Off: a superuser adds accounts
+# under Admin.
+SIGNUP_ENABLED=false
+
 # Local time for schedules; set from the root .env by scripts/setup.sh.
 TZ=UTC