feat: add registration access ui contracts

docs/contracts.md

@@ -30,6 +30,19 @@ HTTP or RPC adapters should preserve these operation names:
   `accept_family_invitation`
 - `audit_records`, `outbox_events`
 
+## UI Contract Surface
+
+`RegistrationAccessManagementUi` is the optional UI-facing contract facade for
+registration and access management. It returns screen/view models and route
+definitions over `UserEngineService`; transport adapters may serve those as
+HTTP, RPC, desktop, CLI, or rendered HTML.
+
+The facade covers self-service registration, factor status, terms/consent,
+prepared-rights review and claim, active hat selection, admin diagnostics, and
+accessible HTML verification. It does not handle credential entry, MFA
+challenges, token issuance, hidden policy decisions, notifications, or
+service-specific admin consoles.
+
 ## Registration Contract
 
 Registration is a headless user-entry facade. It creates a