Add self-registration: free accounts via email + self-hosted CAPTCHA

New public register.php flow: email + a GD-rendered math CAPTCHA (no
third-party service), a mailed temporary password doubling as email
verification, forced password change on first login. Gated behind a
new ALLOW_SELF_REGISTRATION toggle (default off).

Login moves from username to email (falls back to username for
pre-migration accounts without one yet, mirroring qr-vip's existing
migration 006 pattern) - self-registration needs email as the
identifier. New set_email.php interstitial for legacy accounts.

Adds a small PHPMailer-based Mailer class (SMTP, with an
unauthenticated-relay option via MAIL_SMTP_AUTH=false) since no mail
infrastructure existed in this app before.

.env.example

@@ -13,3 +13,19 @@ DATABASE_PREFIX=
 DATABASE_CHARSET=utf8
 
 MYSQL_ROOT_PASSWORD=change-me-to-a-strong-root-password
+
+# Self-registration: lets visitors create their own free 'admin' account
+# (email + CAPTCHA -> mailed password -> forced reset on first login).
+ALLOW_SELF_REGISTRATION=false
+
+# Only needed when ALLOW_SELF_REGISTRATION=true.
+MAIL_HOST=
+MAIL_PORT=587
+MAIL_ENCRYPTION=tls
+# Set to false to relay unauthenticated through an internal mail server (no
+# MAIL_USERNAME/MAIL_PASSWORD needed in that case).
+MAIL_SMTP_AUTH=true
+MAIL_USERNAME=
+MAIL_PASSWORD=
+MAIL_FROM_ADDRESS=noreply@example.com
+MAIL_FROM_NAME=QRForge