feat(landing): self-serve registration page via Drasl API (B1)

Add a static /register page (en/es/eu) that calls the Drasl REST API v2
directly from the browser: register -> login -> optional skin upload, all
in the pixel design. Guests never touch Drasl's own web UI.

Drasl config gains the pieces this needs:
- CORSAllowOrigins scoped to the apex (the API has no CORS until set;
  never "*").
- [RateLimit] for the now public-facing anonymous POST /users.
- [RegistrationNewPlayer] with RequireInvite driven by a new
  REGISTRATION_MODE (invite|open) .env flag.

REGISTRATION_MODE has two consumers from one key: render-config.sh derives
the TOML boolean for Drasl (drasl is TOML-only, no env), and the landing
build reads it to show/hide the invite-code field. render-config.sh halts
on any value other than invite/open.

Security verified against drasl source: anonymous POST /users cannot set
privileged fields (isAdmin/isLocked/chosenUuid/maxPlayerCount are gated on
callerIsAdmin in CreateUser), so browser-direct registration is safe.

Docs: plan/16-landing-registration.md captures the design + the B1 vs fork
decision; build-order, deploy, and the deploy skill wire REGISTRATION_MODE
and the landing-rebuild requirement (www/ is gitignored, not updated by a
git pull).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plan/14-deploy.md

@@ -37,6 +37,21 @@ ssh cochi 'set -e
 `render-config.sh` re-renders configs (and `render-pack.sh` for the packwiz
 pack) from `.env` before the stack comes back up.
 
+### Landing rebuild (not part of `compose`)
+
+The landing site (incl. `/register`) is static `www/`, gitignored — a `git pull`
+does **not** update it. Rebuild on the host whenever `landing/` changed or you
+toggled `REGISTRATION_MODE` (it bakes the invite-field on/off at build, and Drasl's
+`RequireInvite` is derived from the same key by `render-config.sh`):
+
+```bash
+( cd landing && set -a && . ../.env && set +a && pnpm run build )   # → www/
+docker compose restart drasl     # apply CORS / RateLimit / RequireInvite
+```
+
+`down`/`up` is not needed for a landing-only or flag-only change — rebuild `www/`
+and restart `drasl`.
+
 ## What survives a hard restart
 
 Named volumes persist — world and auth data are safe:
@@ -52,8 +67,9 @@ restart (a few minutes); they reconnect once `minecraft` is healthy again.
 
 - SSH access as the `cochi` alias.
 - `.env` present and complete: `BASE_DOMAIN`, `RCON_PASSWORD`, `CADDY_HTTP_PORT`,
-  `CADDY_HTTP_BIND`, `DISTRIBUTION_WEB_ROOT`, and the Let's Encrypt block
-  (`render-config.sh` halts on an unset `BASE_DOMAIN`).
+  `CADDY_HTTP_BIND`, `DISTRIBUTION_WEB_ROOT`, `REGISTRATION_MODE` (`invite`|`open`,
+  defaults `invite`), and the Let's Encrypt block (`render-config.sh` halts on an
+  unset `BASE_DOMAIN` or an invalid `REGISTRATION_MODE`).
 - Docker + compose plugin, `packwiz`, `envsubst`, `git`.
 - Host nginx + Let's Encrypt certs installed once — see `15-letsencrypt.md`.
 - **First deploy only** — online prep (build landing, fetch launcher, fetch