feat(registration): add a domain allow list

add:
 - OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS to specify list of domains allowing a self registration
 - OXICLOUD_REQUIRE_VERIFIED_EMAIL=true|false
 - OXICLOUD_AUTH_METHODS=password,magic_link (login methods, OIDC is on top of this)
 - OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users (OIDC is on top)

example.env

@@ -597,6 +597,29 @@ OXICLOUD_WOPI_ENABLED=false
 # Example (only addresses on these two domains can be invited):
 #OXICLOUD_EXTERNAL_EMAIL_DOMAINS=partner-a.com,partner-b.io
 
+# Allowlist of email domains accepted on the public POST /api/auth/register
+# endpoint. Comma-separated, case-insensitive, exact-match on the post-`@`
+# part of the address. Empty (the default) = any domain is allowed.
+#
+# DISTINCT from OXICLOUD_EXTERNAL_EMAIL_DOMAINS above: this one gates
+# SELF-registration (a stranger signing up), while the external list
+# gates INVITATIONS (an admin/user sharing to an outside address).
+# An operator can, for example, keep public sign-up locked to their
+# own company domain while allowing invitations to any customer:
+#   OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS=mycompany.com
+#   OXICLOUD_EXTERNAL_EMAIL_DOMAINS=            (empty)
+#
+# Wildcards / subdomain semantics are intentionally NOT supported:
+# `mycompany.com` does not match `eng.mycompany.com`. List every subdomain
+# explicitly when needed.
+#
+# Rejected registrations return HTTP 403 with error code
+# `RegistrationDomainNotAllowed` and log an `audit` line with
+# reason=domain_not_allowed for operator visibility.
+#
+# Example (only staff at these two domains can self-register):
+#OXICLOUD_REGISTRATION_ALLOWED_EMAIL_DOMAINS=mycompany.com,mycompany-eu.com
+
 # Per-sharer rate limit on email-type grants from POST /api/grants. Keyed on
 # the authenticated caller's user_id. Hitting the cap returns 429 with
 # Retry-After. Default 50/hour — generous for legitimate admin invites,