Harden Sæby demo registration and department scope (#335)

Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.

services/nginx/app/tests/Unit/Auth/PublicRegistrationAbuseControlsContractTest.php

@@ -0,0 +1,18 @@
+<?php
+
+it('applies separate IP and identity throttles to public customer registration', function (): void {
+    $code = preg_replace(
+        '/\s+/',
+        ' ',
+        (string)file_get_contents(app_path('routes/authRoute.php'))
+    );
+
+    expect($code)->toContain("\$this->post('/auth/register/cvr', function () {");
+    expect($code)->toContain('$this->requireRecaptcha();');
+    expect($code)->toContain("requirePublicRegistrationRateLimit('customer_ip', 'all')");
+    expect($code)->toContain("'customer_identity', 'cvr:' . (string)\$cvr . ':phone:' . \$companyPhone, 3, 60 * 60, false");
+    expect($code)->toContain("'enabled' => defined('redis')");
+    expect($code)->toContain('incrementWithExpiration($key, $windowSeconds)');
+    expect($code)->toContain("Registration protection is temporarily unavailable.");
+    expect($code)->not->toContain("\$attempts = (int)(\$redis->get(\$key)");
+});