The Islamic State suicide bomber who killed 10 German tourists in the heart of Istanbul registered here as a Syrian refugee without setting off security alerts—even though his brother had blown himself up in Syria, Turkish officials said.