docs: register/login as first-run, and a Forgot password section

opsimate-docs/docs/getting-started/configuration.md

@@ -100,13 +100,33 @@ mailer:
   secure: false
   from: "OpsiMate <opsimate@example.com>"
   mailLinkBaseUrl: "https://opsimate.example.com"
+  # replyTo: "support@example.com"        # optional Reply-To on every email
+  # tls:
+  #   rejectUnauthorized: false           # only for a self-signed certificate
+  # templates:
+  #   welcomeTemplate:
+  #     subject: "Welcome to OpsiMate!"   # default subject of the welcome email
+  #     content: "<p>Custom greeting here</p>"  # replaces the greeting paragraph (HTML)
   auth:
     user: "your-smtp-username"
     pass: "your-smtp-password"
 ```
 
 Replace the example values with your SMTP provider's settings. Set `from` to a sender address your provider allows, and set `mailLinkBaseUrl` to the public URL of your OpsiMate frontend, without a trailing slash. Password-reset emails require this URL to build the reset link.
 
+Four optional keys refine what is sent:
+
+| Key | What it does | Default |
+| --- | --- | --- |
+| `replyTo` | Reply-To address added to every email OpsiMate sends. Left out when unset. | unset |
+| `tls.rejectUnauthorized` | Passed to the SMTP connection. With no `tls` section, Nodemailer's defaults apply and a certificate that cannot be verified is rejected. Set `false` **only** for an SMTP server with a self-signed certificate — it turns off certificate checking. | Nodemailer default |
+| `templates.welcomeTemplate.subject` | Subject line of the welcome email. | `Welcome to OpsiMate!` |
+| `templates.welcomeTemplate.content` | Replaces the greeting paragraph of the welcome email. Inserted as HTML, so plain text or simple HTML both work; the Documentation / Slack / GitHub links below the greeting are always kept. | the built-in greeting |
+
+The welcome email is sent once, when the **first admin** registers. Users an admin adds later in Settings → Users do not get one.
+
+All four keys are YAML-only: there is no environment variable for `replyTo`, `tls`, or the welcome template, just as there is none for `secure`.
+
 Use `secure: false` with port 587 for STARTTLS, or `secure: true` with port 465 for TLS from the start, according to your provider's instructions. See the [Nodemailer SMTP options](https://nodemailer.com/smtp#general-options) for details.
 
 Email requires `enabled: true`, a host, a port, and both authentication fields. When a loaded YAML file enables email but omits any of those SMTP fields, OpsiMate disables email and logs a warning. Keep credentials out of version control, and restart the server after changing its configuration.
@@ -125,7 +145,18 @@ When `CONFIG_FILE` is unset or points to a file that does not exist, the server
 | `SMTP_FROM` | Sender address, equivalent to `mailer.from`. |
 | `APP_BASE_URL` | Public frontend URL, equivalent to `mailer.mailLinkBaseUrl`. |
 
-These variables do **not** override a loaded YAML configuration. If your deployment sets `CONFIG_FILE` to an existing file, configure `mailer` in that file instead. There is no SMTP environment variable for `secure`; use YAML when your provider requires `secure: true`.
+These variables do **not** override a loaded YAML configuration. If your deployment sets `CONFIG_FILE` to an existing file, configure `mailer` in that file instead. There is no SMTP environment variable for `secure`; use YAML when your provider requires `secure: true`. The same goes for `replyTo`, `tls` and the welcome template: YAML-only.
+
+## Login
+
+A top-level `login.default_email_domain` key lets people sign in with a bare name: `dana` signs in as `dana@company.com`. A leading `@` in the value is ignored and the value is lower-cased.
+
+```yaml
+login:
+  default_email_domain: "company.com"
+```
+
+When the key is not in the file, the server reads `LOGIN_DEFAULT_EMAIL_DOMAIN` from the environment, in either mode (YAML or environment-only). Unset means login takes the full email only. The same domain completes a bare `owner` name sent by an integration; see [configuration_example](https://github.com/OpsiMate/OpsiMate/blob/main/configuration_example/README.md).
 
 ### Check the Connection
 

opsimate-docs/docs/user-management/register-login.md

@@ -6,13 +6,13 @@ sidebar_position: 1
 
 - OpsiMate provides secure user authentication.
 
-## Registration
+## First-run: creating the admin account
 
-New users can register for OpsiMate access:
+Registration is a first-run step, not a sign-up page. While no user exists, the app sends every visitor to `/register` and shows a **Create First Admin User** form (email, full name, password). The password needs at least 6 characters and no spaces. After it succeeds you are signed in straight away, and the account is an **Admin**.
 
-1. Enter your email address
-2. Create a secure password
-3. Verify your email address
+The first registration then closes: with any user present, `POST /api/v1/users/register` answers 403 "Registration is disabled after first admin". Everyone else is added by an admin in **Settings → Users → Add User**, or signs in through [directory login (LDAP)](./ldap.md) if that is set up.
+
+No email verification happens at any point. If the [mailer is configured](../getting-started/configuration.md#email-smtp-configuration), the new admin receives a one-time welcome email — that is the only welcome email OpsiMate sends.
 
 <div style={{textAlign: 'center', margin: '30px 0'}}>
   <img src="/img/register.png" alt="OpsiMate Register" style={{width: '350px', maxWidth: '100%', height: 'auto', borderRadius: '8px', boxShadow: '0 4px 12px rgba(0,0,0,0.15)'}} />
@@ -21,11 +21,21 @@ New users can register for OpsiMate access:
 
 ## Login
 
-Existing users can log in to access their dashboard:
+Sign in with your email and password. A wrong email or password shows "Invalid email or password".
+
+If the server sets [`login.default_email_domain`](../getting-started/configuration.md#login), the field reads **Email or username** and a name without `@` signs in as `name@<domain>` — `dana` becomes `dana@company.com`. With LDAP on, directory users sign in here with their directory password; local accounts, including the first admin, keep signing in with their OpsiMate password. See [Directory login (LDAP)](./ldap.md).
+
+## Forgot password
+
+The **Forgot password?** link on the login page is shown only when email is enabled on the server, with [`mailLinkBaseUrl` set](../getting-started/configuration.md#email-smtp-configuration).
+
+1. Enter your email. The server sends a link to `<mailLinkBaseUrl>/reset-password?token=…`, valid for **15 minutes**.
+2. Choose a new password: at least 8 characters, no spaces, and different from your current one.
+3. An expired or already-used link shows "This password reset link is no longer valid", with a button to request a new one.
+
+For an unknown email, or a directory (LDAP) account, the server sends nothing but answers exactly as if it had, so the page cannot be used to find out who has an account.
 
-1. Go to the login page
-2. Enter your email and password
-3. Click "Sign In" to access your dashboard
+To change your own password later, use **Profile → edit → Change Password (Optional)** (at least 6 characters). Directory accounts see a note that their password is managed by the directory instead.
 
 <div style={{ display: 'flex', justifyContent: 'center', gap: '30px', margin: '30px 0', flexWrap: 'wrap' }}>
   <div style={{ textAlign: 'center' }}>