fix: handle duplicate email sign-up and null user in protected layout

- Register action now returns success instead of redirecting to /account/setup
  so users without a session (duplicate email with requireEmailVerification)
  see a 'check your email' message instead of crashing
- Protected layout guards against null/undefined locals.user before querying
  Prisma (was passing id: undefined)
- Updated register page to show success banner with verification instructions
- Updated test to match new action response

src/routes/(protected)/+layout.server.ts

@@ -3,8 +3,12 @@ import { error, redirect } from '@sveltejs/kit';
 import { prisma } from '$lib/db';
 
 export const load: LayoutServerLoad = async ({ locals }) => {
+	if (!locals.user?.id) {
+		throw error(403, 'not authorized');
+	}
+
 	const user = await prisma.user.findUnique({
-		where: { id: locals.user?.id },
+		where: { id: locals.user.id },
 		select: { id: true, roleId: true, profile: { select: { id: true } } }
 	});
 	if (!user) {