Bind password setup grants to approved company welcome pages

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

workplans/NK-WP-0037-vergabe-company-welcome.md

@@ -0,0 +1,56 @@
+---
+id: NK-WP-0037
+type: workplan
+title: "Bind password setup to the Vergabe company welcome and sign-in"
+domain: infotech
+repo: net-kingdom
+status: active
+owner: codex
+topic_slug: netkingdom
+created: "2026-09-12"
+updated: "2026-09-12"
+related: [VERGABE-WP-0019, KEY-WP-0033, RAPPS-WP-0014]
+---
+
+## Keep the company return inside the one-use setup grant
+
+```task
+id: NK-WP-0037-T01
+status: done
+priority: high
+```
+
+PasswordSetupGrants now accepts an exact tenant-to-HTTPS-entry mapping, copies
+it at startup, and stores the destination inside the recipient's grant when
+issuing a setup link. Only successful password setup releases the company link.
+The service-authenticated provisioning tenant selects it; browser return fields
+are ignored. No recipient, credential or setup token travels to the product.
+The product performs its own fresh login and explicit account confirmation.
+
+Sixteen provisioner tests pass, including real HTTP issuance/completion,
+malicious return fields, replay/expiry, other tenants and configuration validation.
+Existing setup links remain process-local and expire on restart.
+
+## Bind and release the provider and company client
+
+```task
+id: NK-WP-0037-T02
+status: todo
+priority: high
+```
+
+Register public client vergabe-demo-company with only openid/profile/groups,
+authorization_code and the exact callback
+https://vergabe-teilnahme.coulomb.social/demo-company/accounts/oidc/callback/.
+No client-declared tenant, secret, public registration or MFA downgrade.
+Preserve all existing KeyCape configuration using the established guarded
+client-registration lane. KEY-WP-0033 retains fresh-login propagation and the
+shared issuer rollout preflight.
+
+Set PASSWORD_SETUP_TENANT_RETURNS to map tenant:trial:demo-company to
+https://vergabe-teilnahme.coulomb.social/demo-company/. Publish and pin the
+provisioner image with its 25m/32Mi request unchanged. Preserve the password
+setter, credential references and directory contents. Recipient sign-in and
+provider-required MFA need an attended acceptance; no credential capture or
+operator impersonation. VERGABE-WP-0019-T06 owns product acceptance and
+RAPPS-WP-0014 retains application placement and recovery.