[Audit][P1] Repair registration, login, and password-reset flows

## Context

Registration, login redirects, and password-reset handling are spread across `init` hooks and templates. Several paths lack validation or run after output has started.

Audit findings: 8, 9, 11, 12, and 13.

## Scope

- Move mutations and redirects to appropriate pre-render WordPress hooks or endpoints.
- Validate redirect destinations and use `wp_safe_redirect()` where applicable.
- Add server-side validation, sanitization, request integrity, and abuse controls to registration.
- Correct malformed reset URLs and remove duplicate password-reset document wrappers.

## Done when

- Registration, login failure, reset request, and reset confirmation pass integration tests.
- Redirects occur before output and remain on approved hosts.
- Each response contains one header, footer, and HTML document.