fix(backend): disable one-registration-per-IP by default

Shared NAT egress makes client IP unusable for uniqueness checks. Gate the
behavior behind REGISTRATION_ENFORCE_IP (default false) for public/invite signup.

deploy/helm/pargar/templates/backend.yaml

@@ -66,6 +66,8 @@ spec:
               value: {{ .Values.backend.env.devMode | quote }}
             - name: SEED_CURRICULUM
               value: {{ .Values.backend.env.seedCurriculum | quote }}
+            - name: REGISTRATION_ENFORCE_IP
+              value: {{ .Values.backend.env.registrationEnforceIP | quote }}
             - name: ADMIN_NAME
               value: {{ .Values.backend.admin.name | quote }}
             - name: ADMIN_USERNAME

deploy/helm/pargar/values.yaml

@@ -44,6 +44,8 @@ backend:
   env:
     devMode: "false"
     seedCurriculum: "false"
+    # false behind NAT / shared egress (peer IP is not a real client).
+    registrationEnforceIP: "false"
     donationEnabled: "true"
     # Offline payment only — leave off until ops process is ready; enable in admin settings.
     physicalCertEnabled: "false"