[BUG] ACCOUNT_ALLOW_SIGN_UP does not disable signup for the Obico mobile app

[burritosoftware]

Describe the bug
Similar to #662 but for the mobile app. When setting ACCOUNT_ALLOW_SIGN_UP=False in the .env file, if you enter your Obico server URL into the mobile app, the sign up form appears during onboarding and you can successfully create an account.

To Reproduce
Steps to reproduce the behavior:

1. Set ACCOUNT_ALLOW_SIGN_UP=False in your obico-server/.env file and restart the Docker stack
2. Perform a clean-install of the Obico mobile app (I reinstalled the app on iOS to get the onboarding)
3. Select that you have a self-hosted server, enter your server URL, and relaunch.
4. Go through the onboarding, press Sign Up/Sign In, and create an account.

Screenshots
N/A

Hosting environment (please complete the following information):

• OS: iOS 18.5, Ubuntu 22.04 LTS
• Version: release branch commit e3993e8 (latest at time of bug report)
• Hardware: Proxmox LXC Container

Additional context
N/A

[burritosoftware]

Mitigations
Since this allows anyone to use your own selfhosted Obico instance even when you disabled signups, here are some mitigations.

You need to redirect /mobile/auth/signup/ to /mobile/auth/login/. With NGINX you can do this like so:

location /mobile/auth/signup/ {
    return 301 http://$host/mobile/auth/login/;
  }

Or, if you run Obico through Cloudflare (which is how I have my instance setup), block the /mobile/auth/signup route using Access. Create a "Self-hosted" application, add a public hostname and enter the route (example screenshot below). Then save and add the app, and now this endpoint will be protected behind Access and your configured identity providers. You can then bypass the signup screen by force quitting and relaunching the Obico app to get to the main sign-in screen.

I also like to put /accounts/signup and /accounts/password/reset behind Access, as well as /admin as an extra layer of security for my Obico instance.

[kennethjiang]

Thank you for submitting this bug. Any reason why we can't implement the same mechanism to disable sign up as how it works in the web app?