ENABLE_OPENID_SIGNUP let anyone with an OpenID URL register despite DISABLE_REGISTRATION (an account was created that way on 2026-09-30). All logins go through Pocket ID now. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>