fix(register): onSubmit now calls await session.retry() before going to /register/pending

features/register_redirects_to_pending.feature

@@ -0,0 +1,39 @@
+Feature: Registering lands on the Check your email screen
+  As a visitor who has just created the owner account
+  I want to see the "Check your email" screen
+  So that I know to open the verification link, instead of being sent to log in with "Your session expired"
+
+  Background:
+    Given /register is a "public" route and /register/pending is a "session" route, per docs/design/routes.md
+    And POST /v1/auth/register is public and, on 200, sets the HttpOnly jwt cookie of the new unverified account
+    And the session store caches the result of GET /v1/auth/me, and a cached 401 is stored as session null with status "ready"
+    And RegisterView, on a 200 from POST /v1/auth/register, writes the submitted email to sessionStorage "renewcms:pendingEmail", awaits session.retry(), then navigates to /register/pending
+
+  Scenario: Register after the session store cached an anonymous 401
+    Given the visitor opened "/" first, GET /v1/auth/me answered 401, and the session store holds null with status "ready"
+    And the visitor is on /register
+    When the visitor submits username "marta", email "marta@renew.example" and a password of 8 or more characters
+    And POST /v1/auth/register answers 200
+    And the following GET /v1/auth/me answers 200 with verified false and email "marta@renew.example"
+    Then the session store holds an unverified account
+    And the app is on /register/pending, not /login
+    And no "Your session expired" alert is shown
+    And a ResultPanel titled "Check your email" reads "We sent a verification link to marta@renew.example. It expires in 2 hours."
+    And its actions are "Log out" and "Cancel registration"
+
+  Scenario: Register as the first page of the visit
+    Given the session store is idle and the visitor opened /register directly
+    When the visitor submits the form and POST /v1/auth/register answers 200
+    Then the app is on /register/pending with the "Check your email" panel for "marta@renew.example"
+
+  Scenario Outline: Register failures never navigate
+    Given the visitor is on /register with a valid form
+    When POST /v1/auth/register answers <status>
+    Then the app stays on /register
+    And <visible>
+    And GET /v1/auth/me is not called
+
+    Examples:
+      | status | visible                                                   |
+      | 403    | the "This site already has an owner" ResultPanel is shown |
+      | 500    | the error alert "Couldn't create the account" is shown    |

features/register_redirects_to_pending.qa.md

@@ -0,0 +1,27 @@
+# QA: Registering lands on the Check your email screen
+
+## Automated (Vitest + Vue Test Utils, `task test:web`)
+
+Mock `fetch` per case. Use a real router (`@/router`), a fresh Pinia and AuthShell with the Nuxt UI
+plugin, as in RegisterView.spec.ts. No Go test: the API already sets the cookie on register.
+
+1. **Stale anonymous session** (regression) — call `useSessionStore().check()` with `GET /v1/auth/me`
+   mocked to 401 so the store holds null / "ready". Mount RegisterView at /register, fill valid
+   values, submit. Mock `POST /v1/auth/register` to 200 and the next `GET /v1/auth/me` to 200
+   `{ verified: false, email: "marta@renew.example" }`. Assert after `flushPromises()` that the
+   current path is `/register/pending`, `/login` was never visited (no `reason=expired`), and
+   `sessionStorage["renewcms:pendingEmail"]` is "marta@renew.example". Must fail on the current code.
+2. **Fresh store** — store idle, `/me` mocked to 200 unverified; assert the path is /register/pending.
+3. **Failures** — 403 shows the owner-exists panel, 500 shows the error alert; in both the path stays
+   /register and `/me` is never fetched.
+4. Update the existing test at RegisterView.spec.ts:328-370 so its fetch router also handles
+   `GET /v1/auth/me`.
+
+## Visual
+
+No new states. `task visual:check -- register` and `-- pending` must stay green.
+
+## Manual
+
+On a fresh install open `/`, go to Create the owner account, register, and confirm the "Check your
+email" panel appears. Real SMTP delivery of the verification mail is manual.