feat: add Enrichr email validation to block disposable addresses on signup

[crisjonblvx]

Summary

Adds backend/app/enrichr.py — a lightweight async wrapper around Enrichr that validates email addresses before they're saved to the database.

Disposable/throwaway email addresses (mailinator, tempmail, guerrilla mail, etc.) are rejected at POST /api/v1/users/signup with a 422 before the user record is ever created.

What this adds:

• backend/app/enrichr.py — is_disposable_email() async helper (~55 lines, uses httpx)
• backend/app/api/routes/users.py — one await is_disposable_email() call in register_user
• .env — ENRICHR_API_KEY= placeholder

Why Enrichr:

• First 1,000 calls/month free
• $0.0001/call after that (validate 1M emails for $100)
• Uses httpx.AsyncClient — fully async, no blocking
• Graceful degradation — if ENRICHR_API_KEY is not set, the check is skipped; on any network error, signup proceeds normally
• No new required dependencies (httpx is already in the project)

Setup: Add ENRICHR_API_KEY to .env — get a free key at enrichrapi.dev

Example

POST /api/v1/users/signup
{
  "email": "test@mailinator.com",
  "password": "..."
}

→ 422 Unprocessable Entity
{
  "detail": "Disposable email addresses are not allowed. Please use your real email."
}

Changes

• backend/app/enrichr.py — validate_email() + is_disposable_email() async helpers
• backend/app/api/routes/users.py — register_user made async, disposable check added
• .env — added ENRICHR_API_KEY= placeholder