Record the human onboarding run and fix password-setup usability

- NK-WP-0036 finished: native onboarding journey completed by the operator.
- NK-WP-0037-T02 waits on key-cape: Authelia 4.38 rejects every human
  prompt=login flow (auth_time precedes request registration).
- identity-provisioner: read-only autocomplete=username field on the setup
  form (submitted value ignored) and an HTTPS sign-in link on completion.
- NK-WP-0041 tracks the fixes and routes Authelia/user-engine findings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e

workplans/NK-WP-0036-restore-user-portal-client-registration.md

@@ -4,12 +4,12 @@ type: workplan
 title: "Restore native portal login and tenant-onboarding integration"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 flavor: implementation
 owner: the-custodian
 topic_slug: netkingdom
 created: "2026-09-11"
-updated: "2026-09-14"
+updated: "2026-09-23"
 related: [KEY-WP-0007, RAPPS-WP-0014, VERGABE-WP-0019]
 state_hub_workstream_id: "6e1358d6-87e4-52e7-b3dd-09abdc48cefc"
 ---
@@ -143,7 +143,7 @@ to export another live Secret. Retain NK-WP-0033's separate incident residuals.
 
 ```task
 id: NK-WP-0036-T05
-status: progress
+status: done
 priority: high
 state_hub_task_id: "46d33ab6-d76b-537f-8d60-32c4451675b5"
 ```
@@ -176,6 +176,27 @@ covers provider login, user create/linkage and password setup as a single
 human attempt. Do not retry a rejected password in a loop. Demo users and
 application admission stay RAPPS-WP-0014 and VERGABE-WP-0019.
 
+2026-09-23: one native onboarding journey was completed as a single human
+attempt by operator Bernd Worsch, acting as both provider and recipient. The
+recipient step used a private browser window. The steps were:
+
+1. The provider signed in to the user portal (KeyCape `user-engine-portal`
+   `auth_success`/`token_issued` at 19:22).
+2. The provider created test recipient "Test Recipient" in
+   `tenant:trial:demo-company` and used Create login. This returned login name
+   `bernd.worsch-99` and the single-use setup handoff.
+3. The recipient set a password through the link.
+4. The recipient signed in to the portal with the login name (KeyCape
+   portal `auth_success` at 19:32).
+
+No password was retried in a loop. The agent handled no credential. The
+account is kept as a labelled test user.
+
+Findings routed to NK-WP-0041: sign-in with a `+` email fails with an LDAP
+filter error; the password manager stored the password without a username;
+there was no sign-in link after setup; the setup link is shown to the
+provider rather than mailed.
+
 
 ## Admit the canonical users hostname and preserve callback validation