I’ve finally found out what the issue is. Frustratingly, it’s not documented and there’s no fix for it (I did find a bug report, which I can’t find again now, but it was closed off).
Registration and password changes are silently failing because I don’t have a HIBP API, and the “check for breaches” (or similar) selection is checked by default. By unchecking this option, registration/password changes work as expected.
It’s a shame that the HIBP aspect can’t be an admin setting and disabled altogether, because I expect a lot of people will experience the same bug.