✨ Implement ENABLE_REGISTRATION via user_api module ✨

- docker/rootfs/usr/local/share/prosody-plugins/mod_user_api.lua: new POST /user-api/register endpoint (JSON, validation, reserved names, per-IP rate limit, refuses when AUTH_TYPE is not internal)
- docker/rootfs/usr/local/bin/entrypoint.sh: read ENABLE_REGISTRATION, load user_api on the main host only when ENABLE_AUTH is on, warn otherwise
- docker/compose.yml: add ENABLE_REGISTRATION
- README.md: document registration

README.md

@@ -90,3 +90,12 @@ buildx
 
 Service accounts (`focus`, `jvb`, `jibri`, `jigasi`) always use local `internal_hashed`.  
 Only SASL PLAIN is offered with `openfire`, since an external check cannot do SCRAM.  
+
+## Registration  
+
+| Variable | Default | Meaning |
+|---|---|---|
+| `ENABLE_REGISTRATION` | `0` | Serve `POST /user-api/register` (used by the jitsi-web `/register` page) |
+
+Requires `ENABLE_AUTH=1` and `AUTH_TYPE=internal`; otherwise it is ignored (with a warning) or refused (403).  
+Rate limited to 5 attempts per IP per hour; reserved names (`admin`, `focus`, `jvb`, ...) are rejected.