- provision-rbac.py: create rock user ([email protected]) matching Forgejo - Email recovery flow: identification -> email stage -> password reset - SMTP via Gmail (gotify-smtp secret, SOPS-encrypted) - Recovery flow bound to brand for login page reset link - minio-provision-paperless: add bucket creation, use quay.io/minio/mc
Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).