Add allow_anonymous namespace setting for email-free commenting
When enabled, commenters can post with just a display name (no email required). Comments are attached to UserSurrogate instead of User.
Trade-offs for anonymous commenters:
- No email notifications for replies
- Cannot edit their comments
- Cannot log in to manage comments
- No cross-site identity
Works with existing moderation (hide_unless_approved) - anonymous comments are never auto-approved when moderation is enabled.