feat: registration_enabled admin setting — hides signup surfaces, gates the API

One boolean (Security > Public Registration) switches the whole public
signup lifecycle: front page + login links, the logged-out sidebar's
Create-an-account (via a package-level templates hook so shared page
templates keep their signatures), GET /register -> 302 /login, and an
early 403 on POST /api/auth/register. First-user exception preserved:
zero admins keeps every route and link reachable for bootstrapping —
same 'users exist' reasoning as the setup gate. Admin user creation is
unaffected by design.

Live E2E verified: flag off hides all surfaces and blocks the POST
(403), flag on restores them (201); the admin UI renders the row
automatically.

templates/header.templ

@@ -271,9 +271,11 @@ templ SidebarSignIn(currentPath string) {
 				<button type="submit" class="btn btn-primary w-full py-1.5 text-sm">Sign In</button>
 			</form>
 			<div id="login-result"></div>
-			<a href="/register" class="block text-center text-xs mt-2 hover:underline" style="color: var(--text-secondary);">
-				Create an account
-			</a>
+			if SignupVisible() {
+				<a href="/register" class="block text-center text-xs mt-2 hover:underline" style="color: var(--text-secondary);">
+					Create an account
+				</a>
+			}
 		</div>
 	</div>
 }