THE IDENTITY MODEL knob. Default (False): a password is a credential, not an
identity — password-only register() on an anonymous session makes the same
account portable (MODIFIED), never deanonymizes; only a verified anchor
(email/phone/social) promotes. Opt-in (True): classic login/password accounts
("90s-style") — a password-only register() promotes the anonymous session
(auth_type="password", REGISTERED).

- conf.py: AUTH_PASSWORD_DEANONYMIZES default False
- password/views.py register(): promote on the no-anchor branch when set
- otp/services.py: document the one opt-in exception on promote primitive
- _capabilities.py + capabilities.meta.json: new auth.registration axis
- tests: opt-in promotion + axis inventory (25→26) + meta-out-of-sync rule

Pair with @stapel/auth-react registrationAnchors including "password".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>