[cross-repo] Control learner registration with approval and trusted domains

[hcs-platform-app]

Projected from ADO Feature #5778 (Project 42). This issue is bot-managed — edits here are not reflected back to ADO and will be reverted.

The hosted Project 42 deployment must not grant learner access to every person who submits a registration. The owner needs approval by default, with an optional exact-domain policy that automatically approves people who prove control of an allowed work email address.

Why now: Accounts and durable learner records are planned, and the access policy must be designed before authentication or database implementation begins.

In scope:

• Use a managed identity provider and keep passwords or authentication secrets out of the Project 42 database.
• Require owner approval for registrations that do not match an enabled trusted domain.
• Automatically approve only after the identity provider verifies an exact, normalized work-email domain.
• Provide owner controls for domain policy, approval, rejection, revocation, and audit history.
• Persist identity links, learner profiles, approval decisions, progress, and transcripts in an exportable application database.
• Compare Clerk, Microsoft Entra External ID, Cloudflare Workers/D1, and Azure-hosted application-data options before selection.

Out of scope:

• Building a custom password, session, MFA, or email-verification system in the learner database.
• Trusting a client-supplied email domain without server-side token and verification checks.
• Automatically trusting common, disposable, look-alike, or subdomain addresses.
• Changing public access to the marketing landing page and open learning/reference content unless separately approved.