fix(registration): enforce server-side closure

[gouveags]

Summary

• enforce the registration window in the POST endpoint, not only in the UI
• default registrations to closed unless REGISTRATIONS_OPEN=true
• document the deployment switch and cover the closed response

Problem

The public form can be hidden while the API remains directly callable. That lets submissions bypass the intended registration window.

Validation

• npm run lint -- --quiet
• npx tsc --noEmit
• npm run test:tournaments
• npx prisma validate
• focused route probe confirms the default response is HTTP 410

Deployment note

Set REGISTRATIONS_OPEN=true only during an active registration window and restart the service after changing it.

[gouveags]

@greptileai review

[gouveags]

Independent security review

Current state/checks: OPEN; Validar aplicação passed and the PR-only AWS publish job is skipped. No unresolved review threads were present.

Findings: No blocking issue found. The fail-closed check runs at the top of the public POST handler, before body parsing, rate-limit writes, FACEIT calls, file writes, or database inserts. The absent/false case is covered with a route-level 410 assertion, and deployment documentation makes the required restart explicit.

Residual/informational: This changes deployment behavior: environments that do not set exactly REGISTRATIONS_OPEN=true will reject every submission. The UI can still display the form independently, so operational rollout should coordinate the frontend window and this server switch. Preserve this early guard when reconciling the shared route with #3, #9, and #11.

[gouveags]

Addressed the integration review in 43e6551: merged current main without rewriting history, kept the fail-closed registration guard before body parsing and side effects, and preserved the deployed active-claim migration/tests. CI is rerunning on the reconciled head; I will treat that fresh run, not the stale pre-merge run, as authoritative.