fix(auth): prevent privilege escalation through public registration

[puemos]

Summary

• Ignore caller-supplied role values during public password registration and always create customer accounts.
• Add a dedicated server-controlled action for creating the initial administrator during instance setup.
• Update role-aware test helpers and add regression coverage for HTTP registration and initial setup.

Testing

• mix test test/craftplan_web/controllers/auth_registration_controller_test.exs test/craftplan_web/live/setup_live_test.exs test/craftplan_web/live/manage/settings_members_live_test.exs test/craftplan_web/controllers/page_controller_test.exs --max-failures 1
• mix test --max-failures 1
• mix format --check-formatted
• mix compile --warnings-as-errors