During beta, the user validates an invitation, enters an email and chooses a password, or uses Apple. Email/password registration no longer sends a Brevo OTP. The backend revalidates the invitation and atomically creates the account, password hash and admission, and consumes the invitation exactly once.

Existing addresses are never overwritten; login and email-code password recovery remain separate. An invitation authorizes registration, not verified ownership of a mailbox. Returning admitted accounts need no new invitation.

After beta, BETA_GATE_ENABLED=false restores ordinary email registration with the Brevo code before password setup; Apple authentication remains unchanged. This switch requires API recreation but no new app build. It does not alter collections, passwords or independent unlimited-scan grants.

Deploy the new API endpoint before releasing the mobile build. No migration is needed. Older app builds retain their email-code registration sequence.

Validation: isolated PostgreSQL tests cover concurrent single-use consumption, duplicate-address refusal, password login and durable admission. Mobile tests cover the no-OTP flow and unchanged recovery. The Maestro flow is prepared but not executed: no emulator was started and no personal account was modified.

Tracking: backend issue #648.