Accounts are created by the admin (Users page) or by npm run seed — public sign-up stays off.