Record the human onboarding run and fix password-setup usability

- NK-WP-0036 finished: native onboarding journey completed by the operator.
- NK-WP-0037-T02 waits on key-cape: Authelia 4.38 rejects every human
  prompt=login flow (auth_time precedes request registration).
- identity-provisioner: read-only autocomplete=username field on the setup
  form (submitted value ignored) and an HTTPS sign-in link on completion.
- NK-WP-0041 tracks the fixes and routes Authelia/user-engine findings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e

workplans/NK-WP-0037-vergabe-company-welcome.md

@@ -9,7 +9,7 @@ flavor: implementation
 owner: codex
 topic_slug: netkingdom
 created: "2026-09-12"
-updated: "2026-09-12"
+updated: "2026-09-23"
 related: [VERGABE-WP-0019, KEY-WP-0033, RAPPS-WP-0014]
 state_hub_workstream_id: "15f59624-ab25-5894-9b05-1e6b261749e5"
 ---
@@ -38,7 +38,7 @@ Existing setup links remain process-local and expire on restart.
 
 ```task
 id: NK-WP-0037-T02
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "8921691b-e7a2-543c-8189-3abc24de1bc7"
 ```
@@ -82,3 +82,35 @@ identity mappings and staff accounts. Native invited-user sign-in/MFA and
 confirmation are now requested from the operator; no user credential was used
 by the agent. Recovery and two-user acceptance remain their existing tasks.
 Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.
+
+### Attended recipient sign-in 2026-09-23 — blocked on fresh-login
+
+Test recipient `bernd.worsch-99` (NK-WP-0036-T05) opened the Vergabe demo
+company in a private window. The sign-in failed with KeyCape's "Sign-in could
+not be completed" page, in this sequence:
+
+1. KeyCape logged `auth_start` for `vergabe-demo-company` at 19:40:54.
+2. The recipient authenticated at Authelia at 19:41:03.
+3. Authelia registered the authorization request at 19:41:04.17 and
+   refused it: "prompt was set to 'login' but auth_time … happened before the
+   authorization request … was registered, indicating that the user was not
+   re-authenticated". It issued no code.
+4. KeyCape's code exchange failed (`token_exchange_error`, then
+   `auth_failed`).
+
+Authelia `4.38` registers a `prompt=login` request only after the login, so
+every human fresh-login flow through KeyCape fails. The earlier "fresh-login
+forwarding" checks were redirect-only and never completed a real login.
+Portal sign-in does not request a fresh login and works.
+
+Ownership: fresh-login propagation belongs to key-cape (KEY-WP-0033). The
+Authelia version and configuration belong to the reference deployment. There
+are two candidate fixes:
+
+- KeyCape enforces freshness itself (`max_age`/`auth_time`) instead of
+  forwarding `prompt=login`;
+- move to an Authelia release whose flow handling supports `prompt=login`
+  (not yet verified upstream).
+
+T02 waits on key-cape. MFA enrollment and account confirmation were not
+reached. Rerun the same recipient once the fix is live.