fix(auth): decouple provider enabled from signup control

pkg/config/templates/config.toml

@@ -169,7 +169,15 @@ web3 = 30
 # secret = ""
 
 [auth.email]
-# Allow/disallow new user signups via email to your project.
+# Controls whether the email authentication provider is enabled (GOTRUE_EXTERNAL_EMAIL_ENABLED).
+# 
+# false = Email provider completely disabled (no login, invites, OTP, or signup)
+# true  = Email provider enabled (login, invites, OTP work; signup requires [auth].enable_signup=true)
+# 
+# Common configurations:
+#   Invite-only:    [auth].enable_signup=false, [auth.email].enable_signup=true
+#   Open signups:   [auth].enable_signup=true,  [auth.email].enable_signup=true
+#   No email auth:  [auth.email].enable_signup=false (regardless of [auth].enable_signup)
 enable_signup = true
 # If enabled, a user will be required to confirm any email change on both the old, and new email
 # addresses. If disabled, only the new email is required to confirm.
@@ -207,7 +215,15 @@ otp_expiry = 3600
 # content_path = "./templates/password_changed_notification.html"
 
 [auth.sms]
-# Allow/disallow new user signups via SMS to your project.
+# Controls whether the phone authentication provider is enabled (GOTRUE_EXTERNAL_PHONE_ENABLED).
+# 
+# false = Phone provider completely disabled (no login, invites, OTP, or signup)
+# true  = Phone provider enabled (login, invites, OTP work; signup requires [auth].enable_signup=true)
+# 
+# Common configurations:
+#   Invite-only:    [auth].enable_signup=false, [auth.sms].enable_signup=true
+#   Open signups:   [auth].enable_signup=true,  [auth.sms].enable_signup=true
+#   No phone auth:  [auth.sms].enable_signup=false (regardless of [auth].enable_signup)
 enable_signup = false
 # If enabled, users need to confirm their phone number before signing in.
 enable_confirmations = false

pkg/config/testdata/config.toml

@@ -176,7 +176,15 @@ provider = "hcaptcha"
 secret = "env(HCAPTCHA_SECRET)"
 
 [auth.email]
-# Allow/disallow new user signups via email to your project.
+# Controls whether the email authentication provider is enabled (GOTRUE_EXTERNAL_EMAIL_ENABLED).
+# 
+# false = Email provider completely disabled (no login, invites, OTP, or signup)
+# true  = Email provider enabled (login, invites, OTP work; signup requires [auth].enable_signup=true)
+# 
+# Common configurations:
+#   Invite-only:    [auth].enable_signup=false, [auth.email].enable_signup=true
+#   Open signups:   [auth].enable_signup=true,  [auth.email].enable_signup=true
+#   No email auth:  [auth.email].enable_signup=false (regardless of [auth].enable_signup)
 enable_signup = true
 # If enabled, a user will be required to confirm any email change on both the old, and new email
 # addresses. If disabled, only the new email is required to confirm.
@@ -214,7 +222,15 @@ subject = "Your password has been changed"
 content_path = "./templates/password_changed_notification.html"
 
 [auth.sms]
-# Allow/disallow new user signups via SMS to your project.
+# Controls whether the phone authentication provider is enabled (GOTRUE_EXTERNAL_PHONE_ENABLED).
+# 
+# false = Phone provider completely disabled (no login, invites, OTP, or signup)
+# true  = Phone provider enabled (login, invites, OTP work; signup requires [auth].enable_signup=true)
+# 
+# Common configurations:
+#   Invite-only:    [auth].enable_signup=false, [auth.sms].enable_signup=true
+#   Open signups:   [auth].enable_signup=true,  [auth.sms].enable_signup=true
+#   No phone auth:  [auth.sms].enable_signup=false (regardless of [auth].enable_signup)
 enable_signup = true
 # If enabled, users need to confirm their phone number before signing in.
 enable_confirmations = false