feat: add optional StopForumSpam registration screening

[melroy89]

Summary

Add optional StopForumSpam IP screening (free service) to password and SSO registrations. Lookups and automatic rejection are disabled by default and configurable in /admin/settings. Automatic rejection requires a database match and both confidence and frequency thresholds (defaults: 95% and 5), before any account or signup messages are created.

Pending applications show the registration-time screening result on the approval page and send an approval-request email to admins who enable signup notifications. The private snapshot is erased on approval, rejection, or deletion; existing in-app notifications are preserved.

Rationale

I got sick of all the spam users and bot registrations on my server.

Additional information

This PR targets upgrade_dependencies and depends on #2162, keeping the feature diff separate from the dependency upgrade.

• Resolve signup IPs through Symfony's trusted-proxy handling, including GitHub signup. Existing logins, account linking, operator-created accounts, and federation are excluded.
• Use HTTPS POST, a three-second deadline, no retries, short-lived cached results, and a shared outbound quota. Failed or unavailable checks continue under the existing approval policy.
• Keep both threshold inputs consistent with Mbin's existing input styling, with server-side numeric validation.
• Include the nullable JSONB snapshot migration and administrator setup/privacy documentation. Apply the migration and restart Messenger workers during deployment.

Validation

• 27 focused unit tests passed (73 assertions), covering parsing, thresholds, cache reuse, timeout/quota failures, email eligibility, snapshot privacy, and defaults.
• 24 focused functional tests passed (269 assertions), covering registration, settings/API validation, approval email recipients/content, snapshot cleanup, trusted/spoofed headers, and rate limiting.
• Migration down/up passed against an isolated PostgreSQL test database; the new user mapping validated.
• Container, Twig, YAML, PHP style, and whitespace checks passed. PHPStan passed for the two new services.
• Chrome verified settings save/persistence, approval-page rendering, and matching input dimensions at desktop and 390px mobile widths, with no new-section overflow.

Stored screening snapshot

registration_screening is a nullable JSONB snapshot retained only for pending applications when screening is enabled. Approval, rejection, or deletion clears it to NULL; automatic rejection creates no user record. It is excluded from user API serialization.

Illustrative example:

{
  "ip": "192.0.2.10",
  "status": "matched",
  "frequency": 12,
  "confidence": 97.5,
  "lastseen": "2026-10-05 10:00:00",
  "checked_at": "2026-10-05T12:00:00+00:00",
  "cached": false,
  "failure": null
}

status is matched, no_match, or unavailable. Unavailable checks have null result fields and a failure reason such as request_failed or quota_exhausted.

Screenshots

Captured from the isolated test instance. The approval example uses a fictional account, reserved example IP, and illustrative screening data.

Desktop settings

Mobile settings

Signup approval

[melroy89]

ok rebased to latest main now.

[melroy89]

Rebased