Embedder Register

Public self-serve register endpoint.

Behaviour:

1. Validate the site_url (https-only, sane host).
2. Look up existing row by contact_email. If found, return 200 with already_registered=True and re-send the verify-email link rather than minting a duplicate. This is the no-enumeration posture: we do NOT 4xx on duplicates because a 4xx would let an attacker probe which BD/AP contacts are already in our system.
3. Otherwise mint a slug + ref_token, insert the row, mint a verify-email magic link (24h), send via Postmark BD.

Rate limiting: a slowapi-style middleware sits upstream in app.main and applies the standard public-endpoint cap. We don't re-implement it here.