Record the human onboarding run and fix password-setup usability

- NK-WP-0036 finished: native onboarding journey completed by the operator.
- NK-WP-0037-T02 waits on key-cape: Authelia 4.38 rejects every human
  prompt=login flow (auth_time precedes request registration).
- identity-provisioner: read-only autocomplete=username field on the setup
  form (submitted value ignored) and an HTTPS sign-in link on completion.
- NK-WP-0041 tracks the fixes and routes Authelia/user-engine findings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e

workplans/NK-WP-0041-onboarding-journey-usability.md

@@ -0,0 +1,77 @@
+---
+id: NK-WP-0041
+type: workplan
+title: "Fix onboarding-journey defects found in the 2026-09-23 human run"
+domain: infotech
+repo: net-kingdom
+status: active
+flavor: implementation
+owner: claude-code
+topic_slug: netkingdom
+created: "2026-09-23"
+updated: "2026-09-23"
+related: [NK-WP-0036, NK-WP-0037, KEY-WP-0033]
+---
+
+Found by the operator's native onboarding run (NK-WP-0036-T05) and the
+blocked Vergabe sign-in (NK-WP-0037-T02). Each item names its owner, and only
+items in this repository are implemented here.
+
+## Password managers and sign-in after password setup
+
+```task
+id: NK-WP-0041-T01
+status: progress
+priority: medium
+```
+
+The setup form had no username field, so browsers stored the new password
+without a login. After setup there was no way on to the sign-in page. The
+source is fixed in `identity-provisioner`:
+
+- The setup form shows the grant's login name as a read-only
+  `autocomplete="username"` field. The submitted value is ignored, and the
+  form no longer sets `autocomplete="off"`.
+- The completion page links to `PASSWORD_SETUP_SIGNIN_URL` (HTTPS only)
+  when there is no company return. The deployment declares
+  `https://users.coulomb.social/`.
+- The completion page still does not show the login name, as an existing
+  test requires.
+
+Four new HTTP tests cover this, and the 32 provisioner tests pass. Remaining:
+publish through the identity-provisioner image lane, then promote the digest
+with operator approval.
+
+## Plus-addressed email sign-in fails with an LDAP filter error
+
+```task
+id: NK-WP-0041-T02
+status: todo
+priority: medium
+```
+
+Authelia's `users_filter` accepts `uid` or `mail`. Sign-in as
+`bernd.worsch+99@gmail.com` failed with "LDAP Result Code 201 Filter Compile
+Error: invalid characters for escape", not a clean result. A probe with fake
+addresses (`nk-probe@example.invalid` compared with `nk-probe+x@…`) showed
+that only the `+` form triggers the error. Establish whether Authelia 4.38
+escapes `+` DN-style inside the filter, and fix it through the reference
+configuration or the version. Users who use plus-addressing cannot sign in
+by email until then.
+
+## Route the portal findings to user-engine
+
+```task
+id: NK-WP-0041-T03
+status: todo
+priority: low
+```
+
+These belong to user-engine:
+
+- The setup link is shown to the provider instead of being delivered to the
+  recipient (journey U04/T03: mail delivery unresolved).
+- The derived login name (`bernd.worsch-99`) is not obvious to the recipient.
+- There is no sign-in link from the user entry once a password has been set.
+
+Send these to user-engine and record the reply.