A "user" isn't one record — it's spread across up to four systems linked by shared ids. There are four entry paths, but only two actually create a user; the others enrol or proxy on top. The primary path is lazy and JWT-triggered: there is no register endpoint.