fix(audit): low-tier — session patient-gate + 201 statuses (L1, L11) + triage

L1: PATCH /session now enforces the patient_records subscription gate like its
sibling endpoints (ownership was already checked; the feature gate was missing).
L11: POST /pre-registration and POST /representation/iban return 201 on create.

Remaining low-tier findings triaged and accepted without change (documented in
docs/audit-backlog.md): L8 is a false positive (FK auto-indexed), L6/L7/L9 are
marginal indexes, L4/L5 are small bounded N+1, L2/L3/L10/L12 are minor — none
with security/integrity impact.

Regression: tests/Audit/LowTierFixesTest (both fail without the fix).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Auth/Controller/PreRegistrationController.php

@@ -70,7 +70,7 @@ class PreRegistrationController extends BaseController
         $this->em->persist($preReg);
         $this->em->flush();
 
-        return $this->success(['uuid' => $preReg->getUuid(), 'status' => $preReg->getStatus()]);
+        return $this->success(['uuid' => $preReg->getUuid(), 'status' => $preReg->getStatus()], 201);
     }
 
     #[Route('/api/v1/admin/pre-registrations', methods: ['GET'])]