feat(users): passwordless user creation via emailed set-password link, display full name instead of username

Admins now create users with a name + email (no password) and role;
a Send Email action (per-user, also reusable for resets) issues a
one-time token and POSTs it to an admin-configurable webhook URL —
intended for a Power Automate flow that delivers the actual email.
The old admin-sets-the-password flow is kept server-side
(LegacyUserCreateWithPassword) but no longer wired into the UI.

Every user-facing surface (top bar, sidebar, user management, audit
log, assignee pickers, dispute notifications) now shows full_name
instead of username, falling back to username when unset.

Also fixes long attack_procedure/expected_detection/suggested_text
text overflowing its container in the template review panels and
Red/Blue team fields (missing break-words on whitespace-pre-wrap
blocks).

backend/app/routers/system.py

@@ -344,6 +344,48 @@ def update_jira_config(
     )
 
 
+class PasswordWebhookConfigOut(BaseModel):
+    configured: bool
+    url: str
+
+
+class PasswordWebhookConfigUpdate(BaseModel):
+    url: str
+
+
+@router.get("/password-webhook-config", response_model=PasswordWebhookConfigOut)
+def get_password_webhook_config(
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_role("admin")),
+):
+    """Return the configured webhook URL used to email set-password links.
+
+    **Requires** the ``admin`` role.
+    """
+    from app.services.password_setup_service import get_password_webhook_url
+
+    url = get_password_webhook_url(db) or ""
+    return PasswordWebhookConfigOut(configured=bool(url), url=url)
+
+
+@router.patch("/password-webhook-config", response_model=PasswordWebhookConfigOut)
+def update_password_webhook_config(
+    payload: PasswordWebhookConfigUpdate,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_role("admin")),
+):
+    """Set the webhook URL used to email set-password links.
+
+    **Requires** the ``admin`` role.
+    """
+    from app.services.password_setup_service import get_password_webhook_url, set_password_webhook_url
+
+    set_password_webhook_url(db, payload.url)
+    db.commit()
+    url = get_password_webhook_url(db) or ""
+    return PasswordWebhookConfigOut(configured=bool(url), url=url)
+
+
 @router.post("/jira-test")
 def test_jira_connection(
     db: Session = Depends(get_db),