Fixes #8042

Right now, if you disable registration, OAuth users can’t register either. This is a problem if you want to manage access through something like Authentik — you’d have to leave general registration wide open just to let OAuth users in.

This adds a simple toggle (“OAuth Registration Allowed”) under Settings > Advanced. When enabled, new users can still create accounts by logging in through an OAuth provider, even when the normal registration form is disabled. Existing users can always log in regardless.

Changes:

• New is_oauth_registration_enabled column on instance_settings (default: false, fully backwards compatible)
• Updated OauthController callback to allow registration when either general reg or OAuth reg is enabled
• Added the toggle to the Advanced settings page with a helper text explaining what it does
• Login page shows a small hint (“New accounts can be created via OAuth login”) when OAuth reg is on but general reg is off
• Added both booleans to the model casts for good measure

/claim #8042