fix(backend): disable one-registration-per-IP by default

Shared NAT egress makes client IP unusable for uniqueness checks. Gate the
behavior behind REGISTRATION_ENFORCE_IP (default false) for public/invite signup.

deploy/compose/compose.yaml

@@ -23,6 +23,7 @@ x-backend-env: &backend-env
   STORAGE_SECRET_KEY: ${RUSTFS_SECRET_KEY:?RUSTFS_SECRET_KEY must be set}
   STORAGE_BUCKET: ${STORAGE_BUCKET:-pargar}
   SEED_CURRICULUM: ${SEED_CURRICULUM:-false}
+  REGISTRATION_ENFORCE_IP: ${REGISTRATION_ENFORCE_IP:-false}
   ADMIN_NAME: ${ADMIN_NAME:-Admin}
   ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}
   ADMIN_EMAIL: ${ADMIN_EMAIL:-admin@example.com}

deploy/helm/pargar/templates/backend.yaml

@@ -66,6 +66,8 @@ spec:
               value: {{ .Values.backend.env.devMode | quote }}
             - name: SEED_CURRICULUM
               value: {{ .Values.backend.env.seedCurriculum | quote }}
+            - name: REGISTRATION_ENFORCE_IP
+              value: {{ .Values.backend.env.registrationEnforceIP | quote }}
             - name: ADMIN_NAME
               value: {{ .Values.backend.admin.name | quote }}
             - name: ADMIN_USERNAME

deploy/helm/pargar/values.yaml

@@ -44,6 +44,8 @@ backend:
   env:
     devMode: "false"
     seedCurriculum: "false"
+    # false behind NAT / shared egress (peer IP is not a real client).
+    registrationEnforceIP: "false"
     donationEnabled: "true"
     # Offline payment only — leave off until ops process is ready; enable in admin settings.
     physicalCertEnabled: "false"