feat: block disposable email signups (#2883)

Reject disposable / throwaway email providers (mailinator, yopmail,
10minutemail, ...) across all signup paths: email/password, Google,
Microsoft, personal OIDC and organisation OIDC. Backed by the
mailchecker package (offline, ~55k domains, subdomain-aware).

Exposes a SIGNUP_DISPOSABLE_EMAIL error code so the signup form and
SSO redirect alert can show a dedicated message instead of the
generic 'signup disabled' one.

package-lock.json

@@ -22308,6 +22308,15 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/mailchecker": {
+      "version": "6.0.20",
+      "resolved": "https://registry.npmjs.org/mailchecker/-/mailchecker-6.0.20.tgz",
+      "integrity": "sha512-mZ3kmtfXzGj06prtNm6d8an7D++Kf1G4jEkPZ1QQyhknYNLkmGoMtfaNPNHJU6E8J+Bm3AcZlIIfq5D6L4MS2g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
     "node_modules/map-stream": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/map-stream/-/map-stream-0.1.0.tgz",
@@ -30939,6 +30948,7 @@
         "konva": "^10.0.9",
         "kysely": "0.29.2",
         "luxon": "^3.7.2",
+        "mailchecker": "^6.0.20",
         "nanoid": "^5.1.6",
         "oslo": "^0.17.0",
         "p-map": "^7.0.4",