fix(registration): check input and store emails in lower case

readme.md

@@ -13,7 +13,8 @@ To Be Played is split into three repositories:
 
 ## Features
 
-- Registration with an invitation code, login with email and password (BCrypt).
+- Registration with an invitation code, login with email and password (BCrypt). Emails are stored trimmed and in
+  lower case (V19, unique on `lower(email)`); a password has 8 characters and at most 72 bytes (BCrypt's limit).
 - Brute-force protection in memory: 5 failed logins per email or 20 per IP, and 10 failed registrations per IP,
   block for 15 minutes with `429 TOO_MANY_ATTEMPTS` and `Retry-After`. Unknown emails cost the same BCrypt time as a
   wrong password, and every failed login gets the same error.