fix: registration whitelist (ALLOW_REGISTRATION_EMAIL) never works when registration is disabled #2731

Describe the bug

When DISABLE_USER_REGISTRATION=true and ALLOW_REGISTRATION_EMAIL is set to a whitelist (e.g. ALLOW_REGISTRATION_EMAIL="alice@example.com"), the registration whitelist never works: every registration attempt is rejected with The user registration has been disabled by the administrator. Please contact the administrator!, even for whitelisted emails.

Root cause

In backend/bizpkg/config/base/base.go, getBasicConfigurationFromOldConfig() populates AllowRegistrationEmail from the wrong environment variable:

AllowRegistrationEmail: os.Getenv(consts.DisableUserRegistration),

It should read ALLOW_REGISTRATION_EMAIL (consts.AllowRegistrationEmail). Because DISABLE_USER_REGISTRATION is set to "true" in this scenario, the whitelist becomes the single-element list ["true"], which never contains a real email, so allowRegisterChecker always returns false.

To Reproduce

1. Set in .env: DISABLE_USER_REGISTRATION=true and ALLOW_REGISTRATION_EMAIL="neuroai@neurotrace.net"
2. Restart the server
3. Try to register an account with neuroai@neurotrace.net

Expected behavior

Only the email(s) listed in ALLOW_REGISTRATION_EMAIL can register; other emails are rejected.

Actual behavior

All registration attempts (including whitelisted emails) are rejected with "The user registration has been disabled by the administrator."

Version

Current main (the bug has existed since the persisted base config was introduced, ~PR #2303, Oct 2025).

Environment

Any (env-based deployment; independent of the database, since getBasicConfigurationFromOldConfig() is the fallback used when no base config is persisted yet).

Additional context

• The original feature PR feat(user): add ENV to control DISABLE_USER_REGISTRATION and ALLOW_REGISTRATION_EMAIL #208 read the correct env var directly; the wrong env var was introduced later when the config moved to the persisted BasicConfiguration.
• AdminAuthMW already uses consts.AllowRegistrationEmail correctly for the admin email fallback; only the registration whitelist path is broken.