Record the human onboarding run and fix password-setup usability

- NK-WP-0036 finished: native onboarding journey completed by the operator.
- NK-WP-0037-T02 waits on key-cape: Authelia 4.38 rejects every human
  prompt=login flow (auth_time precedes request registration).
- identity-provisioner: read-only autocomplete=username field on the setup
  form (submitted value ignored) and an HTTPS sign-in link on completion.
- NK-WP-0041 tracks the fixes and routes Authelia/user-engine findings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e

identity-provisioner/password_setup.py

@@ -79,6 +79,15 @@ class PasswordSetupGrants:
             grant = self._grants.get(digest)
             return grant is not None and grant.expires_at > self.clock()
 
+    def login_name(self, token: str) -> str:
+        """Directory login name bound to a still-valid grant, or empty."""
+        digest = _digest(token)
+        with self._lock:
+            grant = self._grants.get(digest)
+            if grant is None or grant.expires_at <= self.clock():
+                return ""
+            return grant.subject
+
     def consume(self, token: str, password: str) -> str:
         if len(password) < 12:
             raise ValueError("password must contain at least 12 characters")