feat(landing): self-serve registration page via Drasl API (B1)

Add a static /register page (en/es/eu) that calls the Drasl REST API v2
directly from the browser: register -> login -> optional skin upload, all
in the pixel design. Guests never touch Drasl's own web UI.

Drasl config gains the pieces this needs:
- CORSAllowOrigins scoped to the apex (the API has no CORS until set;
  never "*").
- [RateLimit] for the now public-facing anonymous POST /users.
- [RegistrationNewPlayer] with RequireInvite driven by a new
  REGISTRATION_MODE (invite|open) .env flag.

REGISTRATION_MODE has two consumers from one key: render-config.sh derives
the TOML boolean for Drasl (drasl is TOML-only, no env), and the landing
build reads it to show/hide the invite-code field. render-config.sh halts
on any value other than invite/open.

Security verified against drasl source: anonymous POST /users cannot set
privileged fields (isAdmin/isLocked/chosenUuid/maxPlayerCount are gated on
callerIsAdmin in CreateUser), so browser-direct registration is safe.

Docs: plan/16-landing-registration.md captures the design + the B1 vs fork
decision; build-order, deploy, and the deploy skill wire REGISTRATION_MODE
and the landing-rebuild requirement (www/ is gitignored, not updated by a
git pull).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -7,6 +7,14 @@ BASE_DOMAIN=ulicraft.net
 
 RCON_PASSWORD=change-me-to-something-random
 
+# Registration mode for self-hosted accounts (Drasl) + landing register form.
+#   invite = closed; guests need an admin-minted invite code (recommended on a
+#            public, internet-present host). Admin mints via POST /drasl/api/v2/invites.
+#   open   = anyone can self-register with username+password (set [RateLimit]!).
+# Consumed by BOTH render-config.sh (-> Drasl RegistrationNewPlayer.RequireInvite)
+# and the landing build (-> show/hide the invite-code field). Default: invite.
+REGISTRATION_MODE=invite
+
 # caddy host-published port. The host's own nginx terminates TLS and
 # reverse-proxies to caddy by Host header (nginx/ulicraft-caddy.conf.tmpl), so
 # bind caddy to a high localhost-only port — only nginx should reach it.