Default per-user main.py; invite-only by default

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -8,8 +8,8 @@
 
 # --- User accounts (SQLite) ---
 # AUTH_ENABLED=true          # require sign-in for /api/* (except /api/auth/*)
-# AUTH_REGISTER_OPEN=true    # allow POST /api/auth/register
-# AUTH_INVITE_ONLY=false     # require invite token for registration
+# AUTH_REGISTER_OPEN=false   # allow POST /api/auth/register
+# AUTH_INVITE_ONLY=true      # default: require invite token; set false for open signup
 # AUTH_DATABASE_PATH=./data/editor.db
 # AUTH_SESSION_DAYS=14
 # BOOTSTRAP_ADMIN_USERNAME=admin   # first-run only: create superuser if DB has zero users