Cloud sign-up refuses disposable email addresses

[keysersoft]

Why

The licence site grants one trial per email address, so a throwaway inbox buys a fresh 7-day trial every week. These sign-ups also add noise to the funnel numbers and to the drip/winback lists, and every reminder sent to a dead inbox costs sender reputation. Today the cloud has only 9 such accounts (none paid), so this is cheap hygiene rather than a fix for a large problem.

What

• src/auth/disposable-email-domains.json: the disposable-email-domains blocklist (CC0, 9,205 domains, commit 1aac72a).
• isDisposableEmail() matches the domain and any parent domain (a@inbox.yopmail.com is caught; notyopmail.com is not).
• Cloud POST /api/auth/register answers 400 with "Please sign up with a permanent email address. Disposable email addresses are not accepted." The login page already shows the backend message as is.
• The check runs before the address is looked up, on the domain alone, so the answer still reveals nothing about existing accounts.

Not affected

• Forwarding services that deliver to a real inbox: Apple Hide My Email, SimpleLogin, Firefox Relay, DuckDuckGo. They are not on the list, and the tests pin this.
• Self-hosted registration, invitations (they join an existing workspace and start no trial), SSO/SCIM provisioning, and existing accounts.

Tests

• Unit: new disposable-email.util.spec.ts, plus cloud and self-hosted cases in auth.controller.spec.ts; src/auth 285/285; tsc and eslint clean.
• nest build copies the JSON to dist/src/auth/. The compiled util was checked from dist.
• Local HTTP run of the built backend in cloud mode on a throwaway DB: lala@yopmail.com, X@MAILINATOR.COM and a@inbox.yopmail.com got 400 and created no row. jane@gmail.com and abc@privaterelay.appleid.com got the usual neutral 201.