Document self-registration toggle

README.md

@@ -25,8 +25,8 @@ A powerful Django-based task management system with time tracking, tag organizat
 
 ### User Management
 - **Multi-user Support**: Full authentication and user management
-- **Email Verification**: Secure email verification for new user registrations
-- **Admin Approval**: Optional admin approval workflow for new users
+- **Email Verification**: Secure email verification for admin-created or self-registered accounts
+- **Admin Approval**: Optional approval workflow for new users
 - **User Profiles**: Customizable profiles with timezone and notification preferences
 - **Password Management**: Secure password change functionality
 
@@ -119,6 +119,15 @@ Set via environment variable:
 export DJANGO_SETTINGS_MODULE=config.settings.development
 ```
 
+### Registration Control
+
+Self-registration is controlled with `ALLOW_SELF_REGISTRATION`.
+
+- `ALLOW_SELF_REGISTRATION=False` disables public signup and requires an administrator to create accounts
+- `ALLOW_SELF_REGISTRATION=True` enables the `/register/` page and `/api/users/register/` endpoint
+
+If the variable is omitted, self-registration is disabled by default.
+
 ### Database Configuration
 
 The application supports multiple database backends. Choose the one that fits your needs.
@@ -955,11 +964,15 @@ sudo ufw status
 # Log in to the web interface at https://tasks.firebugit.com/admin
 # Use the superuser credentials created in Step 3
 
-# When new users register:
+# If ALLOW_SELF_REGISTRATION=True and new users register:
 # 1. They receive verification email
 # 2. After clicking verification link, you receive admin notification
 # 3. Go to Admin > Users > select user(s) > Actions > "Approve selected users"
 # 4. User receives approval email and can now log in
+#
+# If ALLOW_SELF_REGISTRATION=False:
+# 1. Create users through Django admin or management commands
+# 2. Mark them verified/approved as needed for your onboarding flow
 ```
 
 ### Production Checklist
@@ -994,7 +1007,8 @@ Complete this checklist before going live:
 - [ ] Run `python manage.py migrate` to apply all migrations
 - [ ] Run `python manage.py collectstatic` for static files
 - [ ] Create superuser account for admin access
-- [ ] Test user registration and email verification flow
+- [ ] Confirm `ALLOW_SELF_REGISTRATION` is set correctly for production
+- [ ] Test account onboarding flow (admin-created users or public registration)
 - [ ] Test admin approval workflow
 - [ ] Configure `SITE_DOMAIN` to your production domain
 - [ ] Set appropriate `EMAIL_VERIFICATION_TOKEN_EXPIRY_HOURS`