- docker/rootfs/usr/local/share/prosody-plugins/mod_user_api.lua: new POST /user-api/register endpoint (JSON, validation, reserved names, per-IP rate limit, refuses when AUTH_TYPE is not internal)
- docker/rootfs/usr/local/bin/entrypoint.sh: read ENABLE_REGISTRATION, load user_api on the main host only when ENABLE_AUTH is on, warn otherwise
- docker/compose.yml: add ENABLE_REGISTRATION
- README.md: document registration
- docker/rootfs/usr/local/share/prosody-plugins/mod_auth_openfire_hybrid.lua: moved from docker/rootfs/prosody-plugins-contrib/ (rootfs top level may only hold root/, tmp/, usr/)
- docker/rootfs/usr/local/bin/entrypoint.sh: add /usr/local/share/prosody-plugins to plugin_paths
- docker/rootfs/usr/local/bin/entrypoint.sh: honor AUTH_TYPE (internal|openfire) for the global and main-host authentication module; reject unknown values
- docker/rootfs/prosody-plugins-contrib/mod_auth_openfire_hybrid.lua: new auth module, local accounts then Openfire over verified direct TLS, disabled unless OPENFIRE_AUTH_DOMAIN is set
- docker/docker-compose.yml: renamed to docker/compose.yml, map-style env, healthcheck, logging, IPv6 network
- README.md: document the authentication variables
casjay
