Username enumeration via explicit duplicate-name errors

Username enumeration in WSO2 self-registration flows allows remote attackers to identify valid accounts through registration responses. The duplicate-username error path returns an explicit username-already-in-use message instead of a response indistinguishable from unused names. Self-registration must be enabled and network reachable; no authentication is required, and the disclosure is limited to account existence.