Behavior: Completes the registration process for a user who received a guest invitation. The user must have a pending invitation that has not expired. Sets the user's password, verifies their email address, and activates their account so they can log in.

Authorization: Public endpoint — no authentication required. The invitation itself serves as authorization.

Side Effects: Activates the guest user account and marks their email as verified.

Error Scenarios: Returns 400 if the request is null. Throws if the user does not exist, is not in PendingInvitation status, the invitation has expired, no security records exist, or no guest profile is configured.