feat(authentication): add opt-in email restrictions on intake

[kkopanidis]

Summary

• Add opt-in emailRestrictions for authentication email intake: local register, change-email, OAuth new accounts and anonymous upgrade, admin create/patch, gRPC userCreate, and team invites. Login, forgot-password, and magic-link for existing users stay unrestricted.
• Block disposable domains (bundled list), plus-addressing, and configured addresses/domains. Allowlists override those rules, not reserved @anonymous.com.
• @anonymous.com and its subdomains stay reserved for Conduit-created anonymous users, even when the feature is off.
• Also fixes verifyChangeEmail reading verificationToken as a string.

Related

• 0.17: feat(authentication): add opt-in email restrictions on intake #1578
• Conduit-UI: feat(auth): add email restrictions settings Conduit-UI#309
• Docs: docs(authentication): document email restrictions Conduit-Website#144

Test plan

• nvm use 22 && yarn test in modules/authentication (9 tests)
• Enable restrictions, register with a plus-address or disposable domain — EMAIL_NOT_ALLOWED
• Register anything@anonymous.com with the switch off — still rejected
• Change-email token issued before enable still completes on verify