feat(users): passwordless user creation via emailed set-password link, display full name instead of username

Admins now create users with a name + email (no password) and role;
a Send Email action (per-user, also reusable for resets) issues a
one-time token and POSTs it to an admin-configurable webhook URL —
intended for a Power Automate flow that delivers the actual email.
The old admin-sets-the-password flow is kept server-side
(LegacyUserCreateWithPassword) but no longer wired into the UI.

Every user-facing surface (top bar, sidebar, user management, audit
log, assignee pickers, dispute notifications) now shows full_name
instead of username, falling back to username when unset.

Also fixes long attack_procedure/expected_detection/suggested_text
text overflowing its container in the template review panels and
Red/Blue team fields (missing break-words on whitespace-pre-wrap
blocks).

backend/app/routers/tests.py

@@ -1814,6 +1814,7 @@ def request_discussion(
         if rejector_id else None
     )
     rejector_name = rejector.username if rejector else rejector_label
+    rejector_full_name = getattr(rejector, "full_name", None) if rejector else None
     rejector_email = getattr(rejector, "email", None) if rejector else None
 
     # Notify the rejecting lead
@@ -1852,6 +1853,7 @@ def request_discussion(
         "status": "notification_sent",
         "message": f"Discussion request sent to {rejector_name}",
         "rejector_username": rejector_name,
+        "rejector_full_name": rejector_full_name,
         "rejector_email": rejector_email,
         "rejector_role": rejector_label,
     }