2 commits

Author	SHA1	Message	Date
Claus Lohmar	f5e4fd0055	refactor(config): drop the dead secrets.session_key ... REVIEW-001 (M0) L1c/L2s: secrets.session_key was validated and generated by the wizard but never read by any code path — dead config (KISS). Remove the field, its validation entry and its generation; the example notes that a placeholder is replaced at startup in setup mode (M1s) as well as by the wizard's finish.	2026-10-14 11:30:06 +00:00
Claus Lohmar	65618c57db	feat(setup): add the /setup bootstrap wizard (SPEC-005) ... Reserved, setup-mode-only, loopback-only: the domain, the top admin, the authenticator (TOTP), mail/locale — then Finish persists and the dashboard becomes reachable. The wizard IS the bootstrap (D-026); the TOTP key is generated at startup so TOTP enrollment precedes Finish (SPEC-009 D-1).	2026-10-14 10:53:53 +00:00