Register User

Request for user registration with Google OAuth.

The user's email and full name are intentionally NOT accepted from the client — the brain always sources them from the immutable Supabase auth identity (JWT email + auth.users.user_metadata). Accepting them from the request body was a phishing primitive (ENG-1214) that allowed any authenticated user to overwrite public.users.email for their own row with an arbitrary string, e.g. another user's address.

Response for user registration.