feat(registration): anonymous self-signup with email-domain allow-list (#62)

[martinydeAI]

Links to issues

Closes #62.

do-not-merge — depends on PR #105.

This branch is rebased on top of feature/issue-63-account-status-checker
(PR #105) because the integration tests assert that a freshly
registered Pending user cannot sign in — which requires the
AccountStatusChecker from PR #105. Once PR #105 merges into
develop, this branch is rebased onto develop (dropping the
now-redundant checker commits), the do-not-merge label is
removed, and this PR becomes mergeable on its own.

Description

Replaces PR #90. The original PR #90 was based on PR #88's now-orphaned
branch (PR #88 was "merged" into a stacked base that never reached
develop). This PR rebases the registration work onto PR #105 (the
replacement for PR #88's content) so it can land cleanly on develop
once PR #105 does.

Adds anonymous self-signup at /register:

• GET /register — renders the form (email, name, password,
  password confirmation, CSRF token).
• POST /register — validates the inputs, creates the user with
  status = Pending, redirects to /register/pending. On validation
  failure: 422 + re-render with a localised error.
• GET /register/pending — "thanks, your account is awaiting
  approval" landing page.

The validation logic lives in App\Security\Registration (service);
the controller stays thin per project conventions. Each failure
raises a RegistrationException carrying a translation key, which
the controller renders through |trans. CSRF-protected via
csrf_token('register').

Domain allow-list: comma-separated env var
REGISTRATION_ALLOWED_EMAIL_DOMAINS=aarhus.dk,kk.dk,…, bound via
%env(default:…:REGISTRATION_ALLOWED_EMAIL_DOMAINS)% with
example.test as the dev / test default so the app boots without
the var set. Parsing happens once in
App\Security\AllowedEmailDomains (lowercase + trim + dedup + drop
empties).

A pending user created by this route cannot sign in: the integration
test covers the hand-off through PR #105's AccountStatusChecker.

Screenshot of the result

n/a — form re-uses the same Form/* components and base layout as
/login. Manual screenshot can be added on request.

Checklist

• My code is covered by test cases.
• My code passes our test (all our tests).
• My code passes our static analysis suite.
• My code passes our continuous integration process.

Verified locally:

• task coding-standards-check — green.
• task test-coverage — 124 tests, 406 assertions, 100% coverage.

Additional comments or questions

The branch currently carries PR #105's four commits at its base
(rebased from feature/issue-63-account-status-checker). The
"net" diff this PR adds on top is the seven registration-specific
commits. Once PR #105 merges, a rebase onto develop drops the
duplicate base commits and the diff cleans up to just the
registration work.

---

Details - AI specificities

• ADR: docs/adr/006-user-approval-and-account-state.md
  (already on develop). Specifically the "Registration" section.
• Why this replaces PR feat(registration): anonymous self-signup with email-domain allow-list (#62) #90. PR feat(registration): anonymous self-signup with email-domain allow-list (#62) #90 was based on PR feat(security): reject pending and blocked users at login (#63) #88's
  stacked branch (feature/issue-63-account-status-checker). PR
  feat(security): reject pending and blocked users at login (#63) #88 was technically merged but into its now-orphaned base
  (feature/issue-45-user-entity-extension), so PR feat(security): reject pending and blocked users at login (#63) #88's content
  never reached develop. PR feat(security): reject non-approved users at login (#63, #103) #105 is the rebased-onto-develop
  replacement for PR feat(security): reject pending and blocked users at login (#63) #88, and this PR is the rebased-onto-feat(security): reject non-approved users at login (#63, #103) #105
  replacement for PR feat(registration): anonymous self-signup with email-domain allow-list (#62) #90.
• The branch holds PR feat(security): reject non-approved users at login (#63, #103) #105's four commits + the seven
  registration commits. That's intentional during the
  do-not-merge window. After PR feat(security): reject non-approved users at login (#63, #103) #105 lands, those four become
  redundant against develop and a single rebase removes them.
• Out of scope:
  • Email verification — separate decision (per ADR 006).
  • CAPTCHA / rate limiting — defer until abuse becomes an issue
    (per ADR 006).
  • Organization-backed allow-list — separate work after feat: admin CRUD for Organization #76
    lands.
  • Admin approval queue — PR feat(admin): scoped user-management with approval queue (#64, #85) #91 (feat: approval queue for domain managers #64 + feat: scoped user-management list view for admins and domain managers #85), separate concern.
• CSRF intent: register.