test(auth): polish register handler — comment, test isolation, +1 coverage

Quality-review polish on Task 11:

1. One-line comment near the federatedRegistrationOpen default behavior
   noting that the missing-row case is unreachable post-migration but
   falls federation-closed defensively (asymmetric with registrationOpen
   which falls back to env config — by design).

2. The "federated gate blocks token registration" test now sets ONLY
   federatedRegistrationOpen=0, isolating the federated-gate-alone
   effect rather than a both-gates-closed compound.

3. New test: open registration + revoked token → 201 (silently ignored).
   Locks the spec §5.7 invariant "no validation when registration is open"
   against future "let's just validate it for safety" regressions.

4. auth.md prose explicitly notes that federated stub upgrade and new-
   account paths do NOT enter redeemInvite — surfacing the structural
   enforcement of spec §1.3 "tokens never unlock federated creation".

packages/server/src/routes/auth.ts

@@ -85,6 +85,11 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
     const registrationOpen = instanceRow?.registrationOpen !== null && instanceRow?.registrationOpen !== undefined
       ? instanceRow.registrationOpen === 1
       : config.registrationOpen;
+    // instanceRow is guaranteed by ensureDefaults() (migrate.ts) to have id=1
+    // post-boot, with federatedRegistrationOpen NOT NULL DEFAULT 1. The optional
+    // chain is defensive against the impossible-in-production case of a missing
+    // row (e.g., a hand-cleared DB) — falls open-closed rather than open-open
+    // for federation, which is the safer default.
     const federatedRegistrationOpen = instanceRow?.federatedRegistrationOpen === 1;
 
     // Optional invite token. Only meaningful for the local-closed path; ignored