Email domain allowlist for public registration

[tbcsec]

What & why

Adds an admin-configurable email-domain allowlist (Admin → Site settings) so public self-serve registration only accepts email addresses on approved domains, per the approved plan in #56. Subdomains match automatically; a rejected sign-up sees one generic error regardless of whether the email was missing or the domain didn't match, so the allowlist's contents (or existence) are never disclosed.

Fixes #56

Plan step → commit mapping

Plan step	Commit
1. Migration: email_domain_allowlist_enabled + allowed_email_domains columns on SiteSettings	1f68671 Add email-domain allowlist columns to SiteSettings (#56)
2. schemas/site_settings.py: operational fields + validation (normalize/dedupe/cap/reject malformed) + public email_required	43e238f Wire email-domain allowlist into site-settings schemas + router (#56)
3. routers/site_settings.py: _operational_out(), PUT /operational assignment, public GET computing email_required	43e238f (same commit — schema + router changed together)
4. routers/auth.py: enforce in POST /register (after registration_open, before email_taken), generic rejection, new auth/registration_policy.py::domain_allowed helper	252f835 Enforce email-domain allowlist in public registration (#56)
5. schemas/auth.py RegisterRequest.email stays EmailStr | None (policy enforced in router, not the schema)	No change needed — already matches this shape; confirmed as part of 252f835
6. frontend/src/lib/types.ts: email_required + operational fields	bdc1a93 Add email-domain allowlist fields to frontend types + hooks (#56)
7. Admin → Site settings: new card, toggle + tag-input domain list (matches the VocabEditor pattern), subdomain caption	1d132c1 Add email domain allowlist card to Admin -> Site settings (#56)
8. Register page: email_required drives the required attribute + label, server error surfaced (no client-side domain check)	0db1e9f Mark register page email field required when the allowlist is on (#56)
9. Backend pytest coverage (disabled/enabled+missing/mismatch/exact/subdomain/admin-accounts-unaffected)	44a5499 Add backend tests for the email-domain allowlist (#56)
10. Frontend vitest: register page required/optional rendering	005fb36 Add frontend test for register page email requirement (#56)

Deviations from the plan

• Profile email-edit path test (plan step 9, parenthetical "if one exists"): there is no self-service endpoint for a user to edit their own email (only the admin PATCH /api/users/{id} path exists, which the tests do cover as unaffected) — so this sub-case has nothing to test and was skipped.
• Everything else in the Recommendation section is implemented as described; nothing in the "Not in scope" boundary (admin-created accounts, later email edits) was touched.

Checklist

• Backend tests pass — cd backend && .venv/bin/pytest (428 passed)
• Frontend checks pass — cd frontend && npm run test && npx tsc --noEmit && npx eslint . (139 passed, no type/lint errors)
• If UI-observable, I ran it in the browser and confirmed it works — not run in-browser this session; verified via the frontend test suite + manual code review of the toggle/tag-input/register-page wiring instead
• Follows the architectural rules in CONTRIBUTING.md (events, competition_id scoping, require_permission, one hook per domain, design tokens) — no new event needed (reuses site.settings_updated); site settings is not competition-scoped by design; gated on manage_site_settings; changes stay within the existing use-site-settings.ts hook module
• One migration for this PR, named 2026-07-28_3e4f5a6b7c8d_email_domain_allowlist.py
• This is not a security fix (those follow SECURITY.md)

---

Generated by Claude Code