feat: passwordless registration — defer account creation to approval

Removes password from the volunteer registration form. Account
creation is now deferred to the approval step:

Backend:
- Registration creates Person without User (user_id=null)
- On approval, system finds or creates User by person.email
- New accounts get a "set password" email with activation link
- Existing accounts get a portal link email
- Added registration_source column to persons (self/organizer)
- Fuzzy name matching skipped for self-registered persons
- person.email is always source of truth for account linking

Frontend:
- Registration form no longer collects password
- Email check shows info alert with login suggestion
- New wachtwoord-instellen.vue page for account activation
- PasswordRequirements.vue component (reused on reset page)
- Success page updated with activation messaging

Tests: 837 passed (all updated for new flow)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/app/Http/Requests/Api/V1/VolunteerRegistrationRequest.php

@@ -5,7 +5,6 @@ declare(strict_types=1);
 namespace App\Http\Requests\Api\V1;
 
 use Illuminate\Foundation\Http\FormRequest;
-use Illuminate\Validation\Rules\Password;
 
 final class VolunteerRegistrationRequest extends FormRequest
 {
@@ -59,12 +58,6 @@ final class VolunteerRegistrationRequest extends FormRequest
             'field_values' => ['nullable', 'array'],
         ];
 
-        // Password required for unauthenticated registrations
-        if ($user === null) {
-            $rules['password'] = ['required', 'string', Password::min(8)->mixedCase()->numbers()];
-            $rules['password_confirmation'] = ['nullable', 'same:password'];
-        }
-
         return $rules;
     }
 }