#532 Block sign-ups from configured email domains

Summary

• New SIGNUP_BLOCKED_EMAIL_DOMAINS env var on the api: a comma-separated list of email domains that may not create accounts. Subdomains of a listed domain are blocked too; matching is case-insensitive and uses the domain after the last @.
• Enforced in Better Auth's databaseHooks.user.create.before, so it applies to email/password, Google/GitHub, and admin-created users. A blocked attempt returns 403 {"message":"Sign-ups from this email domain are not allowed."} and writes no user row.
• Unset (the default) blocks nothing, so local dev and self-hosted deployments are unaffected.

Useful for shutting off a domain that's sending spam sign-ups without a code change.

Testing

• signup-email-domains.test.ts: parsing, case-insensitivity, subdomains, lookalike domains (notspam.example, spam.example.org), and quoted local parts.
• Checked end to end with Better Auth's memory adapter: POST /api/auth/sign-up/email with a blocked domain → 403 and no user stored; an allowed domain → 200.
• pnpm --filter @superlog/api typecheck passes.

🤖 Generated with Claude Code

---

Summary by cubic

Adds a SIGNUP_BLOCKED_EMAIL_DOMAINS env var that blocks account creation from listed email domains, so a domain sending spam sign-ups can be shut off without redeploying.

New Features

• Accepts a comma-separated domain list; matching is case-insensitive, covers subdomains, and compares the part after the last @.
• Enforced in Better Auth's user creation hook for email/password, social, and admin-created users; blocked attempts return 403 and write no user row.
• Unset by default, so local dev and self-hosted deployments block nothing.