New accounts on a self-hosted dev instance are flagged as staff

(#1050) Bug Needs triage security self-hosting

Thread

Comment by @Divij-Bhoj
RexSystem 1 vote originally by @Divij-Bhoj on GitHub
Users who register through the normal registration process should not be automatically flagged as staff members. The default behavior should be: is_staff = False is_superuser = False Standard user role assigned by default Staff privileges granted only manually by an administrator This ensures proper role separation and prevents unintended privilege escalation.