fix(audit): low-tier — session patient-gate + 201 statuses (L1, L11) + triage

L1: PATCH /session now enforces the patient_records subscription gate like its
sibling endpoints (ownership was already checked; the feature gate was missing).
L11: POST /pre-registration and POST /representation/iban return 201 on create.

Remaining low-tier findings triaged and accepted without change (documented in
docs/audit-backlog.md): L8 is a false positive (FK auto-indexed), L6/L7/L9 are
marginal indexes, L4/L5 are small bounded N+1, L2/L3/L10/L12 are minor — none
with security/integrity impact.

Regression: tests/Audit/LowTierFixesTest (both fail without the fix).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Patient/Controller/PatientController.php

@@ -274,6 +274,7 @@ class PatientController extends BaseController
     public function updateSession(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
     {
         [$entityType, $entityId] = $this->resolveEntity($user);
+        $this->assertPatientGate($entityType, $entityId);
 
         $session = $this->sessionRepo->findByUuid($uuid);
         if ($session === null || !$this->ownsRecord($session->getRecord(), $entityType, $entityId)) {