Create a new user account, open a session, and return the session cookie.

Validation:

• email must be non-empty and well-formed (server-side, not just the UI)
• password must be 8–72 bytes (bcrypt limit)
• persona (optional) must be one of the known values if provided Returns 409 if the email is already registered.

Side effect: a verification email is scheduled via BackgroundTasks (dev: logged) — the account starts unverified but is NOT blocked from using the product. Scheduling it off the request path (IMPORTANT-1a) keeps signup's response time independent of mail-send cost.