Record the human onboarding run and fix password-setup usability

- NK-WP-0036 finished: native onboarding journey completed by the operator.
- NK-WP-0037-T02 waits on key-cape: Authelia 4.38 rejects every human
  prompt=login flow (auth_time precedes request registration).
- identity-provisioner: read-only autocomplete=username field on the setup
  form (submitted value ignored) and an HTTPS sign-in link on completion.
- NK-WP-0041 tracks the fixes and routes Authelia/user-engine findings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e

identity-provisioner/tests/test_company_return_http.py

@@ -75,3 +75,46 @@ class CompanyReturnHTTPTests(unittest.TestCase):
         self.assertEqual(400, status)
         self.assertNotIn('https://app.example/demo/', body)
         self.assertEqual(['recipient'], self.calls)
+
+
+class SetupFormUsabilityTests(CompanyReturnHTTPTests):
+    # Reuses the harness only; the company-return case is covered above.
+    test_authenticated_issue_and_completion_ignore_browser_return = None
+
+    def setUp(self):
+        super().setUp()
+        self.handler.password_setups.tenant_returns.clear()
+
+    def get_form(self, token):
+        with urlopen(self.base + '/setup/password?' + urlencode({'token': token})) as response:
+            return response.read().decode()
+
+    def test_form_offers_read_only_username_for_password_managers(self):
+        body = self.get_form(self.issue())
+        self.assertIn('name="username" value="recipient" readonly autocomplete="username"', body)
+        self.assertNotIn('autocomplete="off"', body)
+
+    def test_submitted_username_is_ignored(self):
+        token = self.issue()
+        request = Request(self.base + '/setup/password', data=urlencode({
+            'token': token, 'username': 'someone-else', 'password': 'fixture-long-password',
+            'confirmation': 'fixture-long-password',
+        }).encode(), headers={'Content-Type': 'application/x-www-form-urlencoded'})
+        with urlopen(request) as response:
+            self.assertEqual(200, response.status)
+        self.assertEqual(['recipient'], self.calls)
+
+    def test_completion_links_to_sign_in_when_no_company_return(self):
+        self.handler.signin_url = 'https://users.example/'
+        status, body, _ = self.submit(self.issue())
+        self.assertEqual(200, status)
+        self.assertIn('href="https://users.example/">Sign in</a>', body)
+        self.assertNotIn('recipient', body)
+
+    def test_expired_link_shows_no_username(self):
+        token = self.issue()
+        self.handler.password_setups.clock = lambda: float('inf')
+        request = Request(self.base + '/setup/password?' + urlencode({'token': token}))
+        with self.assertRaises(HTTPError) as caught:
+            urlopen(request)
+        self.assertNotIn('recipient', caught.exception.read().decode())