Harden public account registration

microservices/AuthApi/DOCUMENTS.md

@@ -9,9 +9,12 @@ Inbound JSON documents
   {
     "username": "string",
     "password": "string",
-    "email": "string (optional)"
+    "email": "string"
   }
   ```
+  Usernames must be 3-24 characters containing only letters, numbers, or
+  underscores. Passwords must contain at least 8 characters, and email is
+  required with a valid address format.
 - LoginRequest (`POST /api/auth/login`)
   ```json
   {
@@ -42,7 +45,7 @@ Stored documents (MongoDB)
     "username": "string",
     "passwordHash": "string",
     "role": "USER | SUPER",
-    "email": "string (optional)",
+    "email": "string",
     "refreshToken": "string (optional)",
     "refreshTokenExpiry": "string (optional, ISO-8601 datetime)"
   }