### What is the current behavior?

When server-side validation rejects the self-account creation form, the
redirect back to the signup page clears every field. This includes
failures that cannot be prevented by client-side validation, such as
duplicate user IDs or email addresses.

### What is the new behavior?

The controller stores only the submitted email, user ID, given name, and
family name for the redirect request. The signup form consumes those
values once and repopulates the corresponding fields.

Password and confirmation values are intentionally never stored or
repopulated.

This keeps server-side validation authoritative and covers every
existing validation/error redirect rather than only rules that can be
duplicated in JavaScript.

### Testing

The self-account-creation Cypress flow now verifies that:

- all four non-password fields remain populated after an invalid
email-domain response;
- password and confirmation fields are empty after the redirect;
- subsequent validation paths can replace the preserved values cleanly.

Local checks: `git diff --check` and JavaScript syntax validation
passed. Full PHP lint and Cypress execution require the Submitty
development environment and are left to CI.

Closes #12490

This is a server-side replacement for the incomplete client-side
approach in #12679.

Co-authored-by: Barb Cutler <[email protected]>

### What is the current behavior?

When server-side validation rejects the self-account creation form, the
redirect back to the signup page clears every field. This includes
failures that cannot be prevented by client-side validation, such as
duplicate user IDs or email addresses.

### What is the new behavior?

The controller stores only the submitted email, user ID, given name, and
family name for the redirect request. The signup form consumes those
values once and repopulates the corresponding fields.

Password and confirmation values are intentionally never stored or
repopulated.

This keeps server-side validation authoritative and covers every
existing validation/error redirect rather than only rules that can be
duplicated in JavaScript.

### Testing

The self-account-creation Cypress flow now verifies that:

- all four non-password fields remain populated after an invalid
email-domain response;
- password and confirmation fields are empty after the redirect;
- subsequent validation paths can replace the preserved values cleanly.

Local checks: `git diff --check` and JavaScript syntax validation
passed. Full PHP lint and Cypress execution require the Submitty
development environment and are left to CI.

Closes Submitty#12490

This is a server-side replacement for the incomplete client-side
approach in Submitty#12679.

Co-authored-by: Barb Cutler <[email protected]>