fix(auth): reject email domains with error website responses

[AM-young-fun]

Problem

Registration treated any HTTP response from an email domain root as a reachable website. Domains returning 400, 403, 500, or 502 could therefore pass the website gate and register.

Root cause

emailDomainWebsiteReachable returned true whenever the HTTP client received a response, regardless of status code. The registration policy also exempted domains whose MX belonged to a major provider, even when the root website was unavailable.

Change

• Treat only HTTP 2xx/3xx responses as a reachable root website; reject 4xx/5xx responses.
• Remove the major-provider MX exemption from the no-website rejection path. Explicit trusted domains remain the administrative bypass.
• Add regression coverage for successful and error HTTP status classes and the major-provider case.

Validation

• go test ./service -run 'TestRegistrationSecurity|TestEmailDomainWebsiteStatus' -count=1 — 21 passed.
• go test ./controller -run 'TestRegister|TestOAuth|RegistrationSecurity' -count=1 — 25 passed.
• go test ./service/... -count=1 — 6 unrelated pre-existing failures in asset-binding tests, including restricted-port listener setup; registration security tests pass.
• git diff --check passes.

Deployment

Router deploy required because registration routes are served on router nodes. Console/staging Go services should receive the same backend build; website, Terraform, and Cloudflare are not involved.