Link optional authenticator setup from session details

Session details now points to the NetKingdom account page and security help.
The app does not show enrollment or require a one-time code. CSOC-WP-0016
is finished in the checkout and does not deploy this image.

Assistant: grok
Assistant-Session: 01a12cc2-e3b2-77a3-8aef-9cc60e577fee

coulomb_social/templates/core/account_session.html

@@ -40,6 +40,17 @@
     </dl>
   </div>
 
+  <div class="card">
+    <h2 style="margin-top:0;">Authenticator app</h2>
+    <p>
+      <a href="https://pink-account.coulomb.social/" rel="noopener noreferrer">Manage authenticator app (optional)</a>
+    </p>
+    <p class="muted">
+      Help for optional setup is on the
+      <a href="https://users.coulomb.social/security" rel="noopener noreferrer">NetKingdom security page</a>.
+    </p>
+  </div>
+
   <div class="card">
     <h2 style="margin-top:0;">Authorization</h2>
     <dl>

docs/session-pickup.md

@@ -9,7 +9,9 @@ Bubble off-ramp, and WP-0015 communication operations/flow acceptance.
 2026-10-11: WP-0013 is active. T01 has the global slug constraint in the checkout;
 the live database is not migrated. T02 has revision purge and copy/move crash
 recovery in the checkout; private corpus review and any live purge remain open.
-T03 remains todo. WP-0012-T01 and WP-0015-T01/T03 still wait on their named owners.
+T03 remains todo. WP-0016 is finished in the checkout: Session details links to
+optional authenticator setup and does not deploy with this task. WP-0012-T01
+and WP-0015-T01/T03 still wait on their named owners.
 
 UC-008 weekly calls and UC-009 personal recovery are accepted. App revision16
 and receiver revision7 are deployed; the receiver uses its existing single-caller

tests/test_shell.py

@@ -93,6 +93,11 @@ def test_account_session_shows_principal_diagnostics(client, settings):
     assert b"Tenant" in r.content
     assert b"Roles" in r.content
     assert b"Groups" in r.content
+    assert b"Manage authenticator app (optional)" in r.content
+    assert b"https://pink-account.coulomb.social/" in r.content
+    assert b"https://users.coulomb.social/security" in r.content
+    assert b"enrolled" not in r.content.lower()
+    assert b"one-time" not in r.content.lower()
 
 
 @pytest.mark.django_db

workplans/CSOC-WP-0016-mfa-setup-link.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Link authenticator setup from the coulomb.social account page"
 domain: communication
 repo: coulomb-social
-status: ready
+status: finished
 owner: claude-code
 topic_slug: coulomb-social
 created: "2026-10-11"
@@ -23,7 +23,7 @@ app.
 
 ```task
 id: CSOC-WP-0016-T01
-status: todo
+status: done
 priority: low
 state_hub_task_id: "b8bb27c0-de32-597e-9106-c5657d7ab130"
 ```
@@ -32,3 +32,8 @@ On the signed-in user's session/account details page, add a "Manage authenticato
 link to `https://pink-account.coulomb.social/` and a short line pointing to
 `https://users.coulomb.social/security` for help. Do not show MFA status unless it comes from an
 authoritative source. Do not make OTP required.
+
+2026-10-11: Session details shows the optional link and the NetKingdom security
+help line. The page does not display enrollment or require a one-time code.
+Password sign-in is unchanged. No separate residual: the link ships with the
+next app image, and this task does not deploy it.