Wire schema upgrade, access guard and registration flag into the app factory

app/__init__.py

@@ -62,6 +62,18 @@ def create_app(config_name='default'):
     from app.models.set import Set
     from app.models.instruction import Instruction
     from app.models.extra_file import ExtraFile
+    from app.models.set_share import SetShare
+    from app.models.site_setting import SiteSetting
+
+    # Add any columns missing from an older database (additive only).
+    if app.config.get('AUTO_SCHEMA_UPGRADE', True):
+        from app.services.schema_upgrade import ensure_schema
+        ensure_schema(app)
+
+    # One place that decides who may see or change a set, covering every
+    # set-scoped route in the app.
+    from app.services.access import install_access_guard
+    install_access_guard(app)
 
     # Create upload directories
     os.makedirs(os.path.join(app.config['UPLOAD_FOLDER'], 'pdfs'), exist_ok=True)
@@ -93,10 +105,12 @@ def create_app(config_name='default'):
     def inject_global_vars():
         from app.services.brickset_api import BricksetAPI
         from datetime import datetime
+        from app.models.site_setting import SiteSetting
         return {
             'app_name': 'LEGO Instructions Manager',
             'brickset_available': BricksetAPI.is_configured(),
-            'current_year': datetime.now().year
+            'current_year': datetime.now().year,
+            'allow_registration': SiteSetting.get_bool('allow_registration', True)
         }
     
     return app