Make self-service signup opt-in via SIGNUP_ENABLED

/users/signup answers 403 unless SIGNUP_ENABLED is set. A public
GET /utils/config/ tells the login page, which hides the sign-up link,
and the signup page explains that an administrator creates accounts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

backend/tests/api/routes/test_users.py

@@ -316,15 +316,32 @@ def test_update_password_me_same_password_error(
     )
 
 
+def test_signup_is_off_unless_enabled(client: TestClient, db: Session) -> None:
+    """An instance nobody configured creates accounts only through Admin."""
+    assert client.get(f"{settings.API_V1_STR}/utils/config/").json() == {
+        "signup_enabled": False
+    }
+    username = random_email()
+    data = {"email": username, "password": random_lower_string(), "full_name": "x"}
+    r = client.post(f"{settings.API_V1_STR}/users/signup", json=data)
+    assert r.status_code == 403
+    assert r.json()["detail"] == "Signup is disabled"
+    assert db.exec(select(User).where(User.email == username)).first() is None
+
+
 def test_register_user(client: TestClient, db: Session) -> None:
     username = random_email()
     password = random_lower_string()
     full_name = random_lower_string()
     data = {"email": username, "password": password, "full_name": full_name}
-    r = client.post(
-        f"{settings.API_V1_STR}/users/signup",
-        json=data,
-    )
+    with patch("fluksio.core.config.settings.SIGNUP_ENABLED", True):
+        assert client.get(f"{settings.API_V1_STR}/utils/config/").json() == {
+            "signup_enabled": True
+        }
+        r = client.post(
+            f"{settings.API_V1_STR}/users/signup",
+            json=data,
+        )
     assert r.status_code == 200
     created_user = r.json()
     assert created_user["email"] == username
@@ -347,10 +364,11 @@ def test_register_user_already_exists_error(client: TestClient) -> None:
         "password": password,
         "full_name": full_name,
     }
-    r = client.post(
-        f"{settings.API_V1_STR}/users/signup",
-        json=data,
-    )
+    with patch("fluksio.core.config.settings.SIGNUP_ENABLED", True):
+        r = client.post(
+            f"{settings.API_V1_STR}/users/signup",
+            json=data,
+        )
     assert r.status_code == 400
     assert r.json()["detail"] == "The user with this email already exists in the system"