The form never fakes a fan row

Create runs the 13+ gate. It does not mint a User without a valid birthday.

Kumir never invents a successful fan row. POST /api/register and POST /api/v1/auth/register run assertEligibleFan before User is created.

A failed birthday or duplicate email does not mint a session.