fix(auth): commit the account on registration so a pre-approved sign-up isn't lost

_register_account() flushed the new User but relied on someone else to commit:
upsert_pending_invite() commits only when it actually writes an invite row, and
_issue_token() runs only when SMTP is enabled. For an email an admin had ALREADY
approved, on an instance where email is unavailable, neither fired — the session
closed and the account was rolled back. The would-be user got the uniform "ok"
and no account, could not sign in, and re-registering was a silent no-op.

Commit explicitly after the invite upsert (a no-op when upsert already committed
the same transaction). Three DB-lane regression tests cover the pre-approved
no-SMTP path (fails without the fix), the unknown-email path that always worked,
and the pre-approved path with SMTP on.

backend/tests/test_auth_session.py

@@ -127,3 +127,72 @@ def test_activating_a_verified_account_keeps_its_password(db, make_user):
     _activate_user_by_email(db, "legit@example.com")
     assert user.is_active is True
     assert user.password_hash is not None
+
+
+def _register_and_fetch(db, email: str):
+    """Run the /register background worker, then read the users/invites rows back through a FRESH
+    query. The worker owns its own session, so anything it failed to commit is simply not there."""
+    from sqlalchemy import select as _select
+
+    from app.models import Invite, User
+    from app.routes.auth import _register_account
+
+    _register_account(email, _PW)
+    db.expire_all()
+    user = db.execute(_select(User).where(User.email == email)).scalar_one_or_none()
+    invite = db.execute(_select(Invite).where(Invite.email == email)).scalar_one_or_none()
+    return user, invite
+
+
+def test_registration_of_a_pre_approved_email_persists_the_account_without_smtp(db, monkeypatch):
+    # The regression: an admin pre-approves an address, the person then registers, and the account
+    # silently never existed. upsert_pending_invite returns early WITHOUT committing for an
+    # already-approved email, and the only other commit on this path (_issue_token) is gated on
+    # SMTP — so on a no-SMTP instance the flushed user was rolled back at session close.
+    from app.models import Invite
+    from app.routes import auth as auth_mod
+
+    monkeypatch.setattr(auth_mod.email_mod, "email_enabled", lambda: False)
+    db.add(Invite(email="roland@example.com", status="approved", decided_by="admin@example.com"))
+    db.commit()
+
+    user, invite = _register_and_fetch(db, "roland@example.com")
+
+    assert user is not None, "pre-approved registration was rolled back — the account is gone"
+    assert user.is_active is False  # admin approval still gates sign-in
+    assert user.password_hash is not None
+    assert user.email_verified is True  # no SMTP => ownership can't be proven by link
+    assert invite.status == "approved"  # an existing approval is never disturbed
+
+
+def test_registration_of_an_unknown_email_still_persists_account_and_pending_invite(
+    db, monkeypatch
+):
+    # The branch that always worked (upsert INSERTs the invite and commits) must keep working.
+    from app.routes import auth as auth_mod
+
+    monkeypatch.setattr(auth_mod.email_mod, "email_enabled", lambda: False)
+
+    user, invite = _register_and_fetch(db, "stranger@example.com")
+
+    assert user is not None
+    assert invite is not None and invite.status == "pending"
+
+
+def test_registration_of_a_pre_approved_email_persists_the_account_with_smtp(db, monkeypatch):
+    # Same pre-approved path with SMTP on: the account must persist AND get a verification link.
+    from app.models import Invite
+    from app.routes import auth as auth_mod
+
+    sent: list[str] = []
+    monkeypatch.setattr(auth_mod.email_mod, "email_enabled", lambda: True)
+    monkeypatch.setattr(auth_mod.email_mod, "send_verify_email", lambda to, link: sent.append(to))
+    monkeypatch.setattr(auth_mod.email_mod, "send_admin_new_request", lambda admins, to: True)
+    db.add(Invite(email="rita@example.com", status="approved", decided_by="admin@example.com"))
+    db.commit()
+
+    user, _ = _register_and_fetch(db, "rita@example.com")
+
+    assert user is not None
+    assert user.email_verified is False  # must confirm the address
+    assert sent == ["rita@example.com"]