Multiple issues with admin-approved self-registration story.

Right now the registrant only receives a confirmation email after his registration his been approved by the admin - making it impossible to have his email verified prior to approval.
The expected behavior would be for the registrant first having to confirm his email address and then receive an additional email once his account been activated.

Additional issues:

Users created with self-registration have their usernames empty leaving it upto the admin to create one, at the very least have it pre-filled as the real name with spaces stripped.

No way to specify the default role for self-registered users ? (as opposed to those registered via 3rd party auths), current default is 'user' whereas a safer default would be 'guest'.

The 'Make Admin' and the 'Activate' buttons are right next to each other neither requiring additional confirmation - a better ui would be to have "activate" as a button and have "make admin" require additional "are you sure?" confirmation.

No files, tests, or entry points are named. Start by locating the self-registration, email verification, approval, role-default, and admin-control flows, then trace how they interact before choosing a scope; done should include the requested registration behavior, safer role handling, and a confirmed admin action for making users administrators.