Design a public self-registration endpoint hardened against automated bot abuse without meaningfully hurting real user experience.

Layer proportionate defenses: a CAPTCHA (only shown after suspicious velocity, not on every legitimate attempt), per-IP and per-email-domain rate limiting, CompromisedPasswordChecker rejection of known-breached passwords, and email verification before the account is fully activated — combined with monitoring for registration bursts from narrow IP ranges or disposable-email domains, which are strong bot signals distinct from normal registration patterns.