Add dual whitelist with context-aware validation

[Naiara]

Summary

• Add dual whitelist support: public-whitelist and private-whitelist
• Apply context-aware validation:
  • public registration uses public-whitelist
  • invitations and other contexts use private-whitelist ∪ public-whitelist
• Remove legacy allowed-domains fallback behavior
• Make empty whitelist restrictive (blocks all domains for that context)
• Add file-based defaults support via EMAIL_WHITELIST_FILE
• Update README with new configuration, examples and troubleshooting

Breaking change

• Empty whitelist now blocks emails for that context (previous behavior was permissive)

Validation

• docker compose run --rm maven mvn clean test
• docker compose run --rm maven mvn clean package