feat(admin): quiet reminder while public registration is open

Registration stays open after the first admin so a household can be
invited, but on an internet-exposed instance that means anyone who can
reach the URL can sign up — and nothing prompted the admin to close it.
Surface a muted hint under the registration toggle whenever it is open
(no behaviour change), and note the reality in getting-started's
first-user section.

docs/self-hosting/getting-started.md

@@ -101,8 +101,8 @@ After the first user lands, you can:
 > host that means strangers can still sign up. Once everyone who needs
 > an account has one, turn it off in **`/admin` → registration toggle**
 > (or keep it open and hand out invite links instead). The admin
-> dashboard shows a reminder while registration is open and you are the
-> only user.
+> settings show a reminder underneath the toggle while registration is
+> open.
 
 > **No email is configured out of the box** — a deliberate first-boot
 > simplicity win, but it also means password reset has no self-service

messages/de.json

@@ -5494,6 +5494,7 @@
     "appSettingsDescription": "Globale Standardwerte für Registrierung, Sprache und Zeitzone neuer Konten.",
     "registrationEnabled": "Registrierung erlauben",
     "registrationEnabledDescription": "Wenn deaktiviert, können sich keine neuen Nutzer registrieren.",
+    "registrationOpenHint": "Die Registrierung ist offen — jeder, der diese Instanz erreichen kann, kann ein Konto anlegen. Schließe sie hier, sobald alle ein Konto haben.",
     "defaultLanguage": "Standard-Sprache",
     "defaultLanguageDescription": "Wird für neue Nutzer und als Fallback verwendet.",
     "defaultUserTimezone": "Standard-Zeitzone für neue Konten",

messages/en.json

@@ -5494,6 +5494,7 @@
     "appSettingsDescription": "Global defaults for registration, language, and the timezone of new accounts.",
     "registrationEnabled": "Allow registration",
     "registrationEnabledDescription": "When disabled, new users cannot register.",
+    "registrationOpenHint": "Registration is open — anyone who can reach this instance can create an account. Close it here once everyone who needs an account has one.",
     "defaultLanguage": "Default language",
     "defaultLanguageDescription": "Used for new users and as fallback.",
     "defaultUserTimezone": "Default timezone for new accounts",

messages/es.json

@@ -5494,6 +5494,7 @@
     "appSettingsDescription": "Valores globales por defecto para registro, idioma y zona horaria de cuentas nuevas.",
     "registrationEnabled": "Permitir el registro",
     "registrationEnabledDescription": "Cuando está desactivado, los nuevos usuarios no pueden registrarse.",
+    "registrationOpenHint": "El registro está abierto: cualquiera que pueda acceder a esta instancia puede crear una cuenta. Ciérralo aquí cuando todos tengan una cuenta.",
     "defaultLanguage": "Idioma predeterminado",
     "defaultLanguageDescription": "Se usa para los nuevos usuarios y como reserva.",
     "defaultUserTimezone": "Zona horaria predeterminada para cuentas nuevas",

messages/fr.json

@@ -5494,6 +5494,7 @@
     "appSettingsDescription": "Valeurs globales par défaut pour l’inscription, la langue et le fuseau horaire des nouveaux comptes.",
     "registrationEnabled": "Autoriser l'inscription",
     "registrationEnabledDescription": "Lorsque cette option est désactivée, les nouveaux utilisateurs ne peuvent pas s'inscrire.",
+    "registrationOpenHint": "L'inscription est ouverte : toute personne pouvant accéder à cette instance peut créer un compte. Fermez-la ici une fois que tout le monde a un compte.",
     "defaultLanguage": "Langue par défaut",
     "defaultLanguageDescription": "Utilisé pour les nouveaux utilisateurs et comme solution de repli.",
     "defaultUserTimezone": "Fuseau horaire par défaut pour les nouveaux comptes",

messages/it.json

@@ -5494,6 +5494,7 @@
     "appSettingsDescription": "Impostazioni globali predefinite per registrazione, lingua e fuso orario dei nuovi account.",
     "registrationEnabled": "Consentire la registrazione",
     "registrationEnabledDescription": "Se disattivato, i nuovi utenti non possono registrarsi.",
+    "registrationOpenHint": "La registrazione è aperta: chiunque possa raggiungere questa istanza può creare un account. Chiudila qui quando tutti hanno un account.",
     "defaultLanguage": "Lingua predefinita",
     "defaultLanguageDescription": "Usata per i nuovi utenti e come ripiego.",
     "defaultUserTimezone": "Fuso orario predefinito per i nuovi account",

messages/pl.json

@@ -5494,6 +5494,7 @@
     "appSettingsDescription": "Globalne ustawienia domyślne rejestracji, języka i strefy czasowej nowych kont.",
     "registrationEnabled": "Zezwól na rejestrację",
     "registrationEnabledDescription": "Gdy wyłączone, nowi użytkownicy nie mogą się zarejestrować.",
+    "registrationOpenHint": "Rejestracja jest otwarta — każdy, kto ma dostęp do tej instancji, może założyć konto. Zamknij ją tutaj, gdy wszyscy będą mieć konto.",
     "defaultLanguage": "Domyślny język",
     "defaultLanguageDescription": "Używany dla nowych użytkowników i jako rozwiązanie zapasowe.",
     "defaultUserTimezone": "Domyślna strefa czasowa dla nowych kont",

src/components/admin/general-settings-section.tsx

@@ -96,6 +96,19 @@ export function GeneralSettingsSection() {
           disabled={updateSettings.isPending}
         />
 
+        {/* Honest nudge: registration stays open after the first admin so a
+            household can be invited, but on an internet-exposed instance that
+            means anyone who can reach the URL can sign up. Surface a quiet
+            reminder while it is open — no behaviour change, just a signal. */}
+        {(settings?.registrationEnabled ?? true) && (
+          <p
+            data-slot="registration-open-hint"
+            className="text-muted-foreground -mt-2 text-xs"
+          >
+            {t("admin.registrationOpenHint")}
+          </p>
+        )}
+
         {/* v1.23 — instance-wide "require a second factor" policy. Every
             account without an active factor is sent to forced enrollment after
             sign-in. This is a web-session nudge, not an API wall: direct API /