fix: expand disposable email domain blocklist

[mvanhorn]

Extend the existing exact-match blockedDomains set with the disposable domains enumerated by the issue, preserving normalization, validation order, error resources, and the current suffix checks. Add a focused AuthEmailValidatorTest that exercises the expanded set through the public validate API instead of exposing or testing the private collection directly. AuthEmailValidator currently rejects only 12 reserved or disposable domains, so the widely used throwaway providers identified in issue #368 pass Android-side account-creation validation. The current main clone confirms that the reported domains are absent from blockedDomains.

Happy path: each newly added disposable domain in a syntactically valid email returns R.string.auth_email_real_required under the default account-creation behavior, while a normal public email domain remains accepted; Edge cases: mixed-case and surrounding-whitespace variants normalize to a newly blocked domain, and an existing blocked domain remains rejected so the expansion does not regress current coverage.

Fixes #368

[mvanhorn]

Thank you for merging the blocklist expansion. Appreciate you taking it with the existing normalization and validation order preserved.