feat(web/m7-user-mgmt): /register page + login link

Public /register form: username, optional display name, password +
confirm, optional invite token. Submits to POST /api/auth/register
via the new register() helper in auth/store.svelte.ts. On success
the server sets the session cookie and the frontend redirects to /;
on error the page shows a code-specific message (invite_required,
invite_invalid, username_taken, etc.).

Login page gets a "Don't have an account? Register" link below the
form for symmetry.

Tests cover form rendering, password-mismatch client-side rejection,
the happy-path submit + redirect, and the invite-invalid error
mapping.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/src/lib/auth/store.svelte.ts

@@ -24,6 +24,23 @@ export async function login(username: string, password: string): Promise<void> {
   _user = res.user;
 }
 
+export async function register(opts: {
+  username: string;
+  password: string;
+  inviteToken?: string;
+  displayName?: string;
+}): Promise<void> {
+  const body: Record<string, string> = {
+    username: opts.username,
+    password: opts.password,
+  };
+  if (opts.inviteToken) body.invite_token = opts.inviteToken;
+  if (opts.displayName) body.display_name = opts.displayName;
+  const res = await api.post<LoginResponse>('/api/auth/register', body);
+  _user = res.user;
+  await bootstrap();
+}
+
 export async function logout(opts: { silent?: boolean } = {}): Promise<void> {
   const userId = _user?.id;
   if (!opts.silent) {