Enroll Public

Public enrollee registration portal route protected by Turnstile AND authentication.

H3 hardening: a valid bearer token naming an ACTIVE ProducerPrincipal is REQUIRED. Enrollment used to proceed anonymously (auto-provisioning a brand-new ProducerPrincipal/Membership) whenever the Authorization header was simply absent — that let anyone silently mint producer accounts with no proof of identity at all. There is no anonymous auto-provisioning path anymore: the caller must already hold a valid access token before it can enroll an adapter.