feat(users): passwordless user creation via emailed set-password link, display full name instead of username

Admins now create users with a name + email (no password) and role;
a Send Email action (per-user, also reusable for resets) issues a
one-time token and POSTs it to an admin-configurable webhook URL —
intended for a Power Automate flow that delivers the actual email.
The old admin-sets-the-password flow is kept server-side
(LegacyUserCreateWithPassword) but no longer wired into the UI.

Every user-facing surface (top bar, sidebar, user management, audit
log, assignee pickers, dispute notifications) now shows full_name
instead of username, falling back to username when unset.

Also fixes long attack_procedure/expected_detection/suggested_text
text overflowing its container in the template review panels and
Red/Blue team fields (missing break-words on whitespace-pre-wrap
blocks).

backend/alembic/versions/b065_full_name_and_password_setup_tokens.py

@@ -0,0 +1,43 @@
+"""Add users.full_name and a password_setup_tokens table.
+
+Users are now created with a name + email instead of a directly-set
+password — the admin's "Send Email" action issues a one-time token (this
+table) for the user to set their own password via a webhook-delivered
+link. The same mechanism is reused for password resets.
+
+Revision ID: b065
+Revises: b064
+Create Date: 2026-07-17
+"""
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision = "b065"
+down_revision = "b064"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("users", sa.Column("full_name", sa.String(), nullable=True))
+
+    op.create_table(
+        "password_setup_tokens",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("user_id", postgresql.UUID(as_uuid=True), sa.ForeignKey("users.id"), nullable=False),
+        sa.Column("token", sa.String(128), nullable=False),
+        sa.Column("expires_at", sa.DateTime(), nullable=False),
+        sa.Column("used_at", sa.DateTime(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+    )
+    op.create_index("ix_password_setup_tokens_token", "password_setup_tokens", ["token"], unique=True)
+    op.create_index("ix_password_setup_tokens_user_id", "password_setup_tokens", ["user_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_password_setup_tokens_user_id", table_name="password_setup_tokens")
+    op.drop_index("ix_password_setup_tokens_token", table_name="password_setup_tokens")
+    op.drop_table("password_setup_tokens")
+    op.drop_column("users", "full_name")