Make self-service signup opt-in via SIGNUP_ENABLED

/users/signup answers 403 unless SIGNUP_ENABLED is set. A public
GET /utils/config/ tells the login page, which hides the sign-up link,
and the signup page explains that an administrator creates accounts.

docs/reference/configuration.md

@@ -111,6 +111,7 @@ remember it is fixed at build time: changing it means rebuilding that image.
 |---|---|---|
 | `ENVIRONMENT` | `local` | `local`, `staging` or `production` |
 | `PRIVATE_API_ENABLED` | `false` | unauthenticated test-only endpoints; needs `ENVIRONMENT=local` too |
+| `SIGNUP_ENABLED` | `false` | lets anyone who reaches the login page create an account; otherwise a superuser adds them under **Admin** |
 | `TZ` | `UTC` | the timezone every schedule is written in |
 
 `TZ` is the container's own, not a setting the code reads: an `inject` or a