Record the human onboarding run and fix password-setup usability

- NK-WP-0036 finished: native onboarding journey completed by the operator.
- NK-WP-0037-T02 waits on key-cape: Authelia 4.38 rejects every human
  prompt=login flow (auth_time precedes request registration).
- identity-provisioner: read-only autocomplete=username field on the setup
  form (submitted value ignored) and an HTTPS sign-in link on completion.
- NK-WP-0041 tracks the fixes and routes Authelia/user-engine findings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e

sso-mfa/k8s/identity-provisioner/deployment.yaml

@@ -37,6 +37,7 @@ spec:
                 secretKeyRef: {name: identity-provisioner-token, key: token}
             - {name: PASSWORD_SETUP_PUBLIC_URL, value: "https://kc.coulomb.social/setup/password"}
             - {name: PASSWORD_SETUP_TTL_SECONDS, value: "900"}
+            - {name: PASSWORD_SETUP_SIGNIN_URL, value: "https://users.coulomb.social/"}
             - name: PASSWORD_SETUP_TENANT_RETURNS
               value: '{"tenant:trial:demo-company":"https://vergabe-teilnahme.coulomb.social/demo-company/"}'
           securityContext: