fix(audit): low-tier — session patient-gate + 201 statuses (L1, L11) + triage

L1: PATCH /session now enforces the patient_records subscription gate like its
sibling endpoints (ownership was already checked; the feature gate was missing).
L11: POST /pre-registration and POST /representation/iban return 201 on create.

Remaining low-tier findings triaged and accepted without change (documented in
docs/audit-backlog.md): L8 is a false positive (FK auto-indexed), L6/L7/L9 are
marginal indexes, L4/L5 are small bounded N+1, L2/L3/L10/L12 are minor — none
with security/integrity impact.

Regression: tests/Audit/LowTierFixesTest (both fail without the fix).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Representation/Controller/RepresentationActionController.php

@@ -172,7 +172,7 @@ class RepresentationActionController extends BaseController
         ]);
         $this->em->flush();
 
-        return $this->success(['data' => $this->repProfile($rep, $user)]);
+        return $this->success(['data' => $this->repProfile($rep, $user)], 201);
     }
 
     #[OA\Delete(