Changes

registration: operator test domains may register for any clinic

Adds REGISTRATION_TEST_DOMAINS (comma-separated). Addresses on those domains skip
the "e-mail domain belongs to the chosen Standort" check, so the flow can be
exercised end-to-end against arbitrary clinics.

That check is the only thing preventing a stranger from registering someone else's
hospital, so it is never relaxed for real users. The bypass therefore:
  - does not exist at all when the variable is empty or unset (the default)
  - never counts as domain-verified (domain_verified stays 0)
  - forces needs_manual_approval and prefixes the note with [TESTREGISTRIERUNG via <domain>]
  - leaves the freemail blocklist and the per-Standort duplicate guard intact

Verified: younex.de/it-beratung.it accepted for a non-matching Charité Standort;
a non-whitelisted business domain and a freemail address both still rejected; and
with the variable unset younex.de is rejected again.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 (commit: d91c3a4)

ci: move the deploy concurrency guard from Jenkins to the target

Every build after the first sat in the queue as a BlockedItem and never started
until Jenkins was restarted - observed three times on this controller. The only
plausible cause was disableConcurrentBuilds(), so it is removed.

The race it guarded against is two deploys swapping the `current` symlink at the
same time. That resource lives on the TARGET, not on Jenkins, so deploy.sh now
takes an flock on /var/lock/blut24-landing-deploy.lock for the whole run. That is
strictly better: it also covers deploys started by hand or from another controller,
which the Jenkins-side option never did.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 (commit: 3365492)