Creates a new user. Request body is JSON:API enveloped (data.attributes).
Signup path is determined by attributes:

• token present → assignee signup (from invitation)
• linking_request_id present → linked-invite signup (accounts-api creates the child org)
• neither → account-owner signup (creates a new org)
  When supplied, contact_number must be an E.164 number with any country code (e.g. +639171234567) — anything else returns 422.