feat(users): passwordless user creation via emailed set-password link, display full name instead of username

Admins now create users with a name + email (no password) and role;
a Send Email action (per-user, also reusable for resets) issues a
one-time token and POSTs it to an admin-configurable webhook URL —
intended for a Power Automate flow that delivers the actual email.
The old admin-sets-the-password flow is kept server-side
(LegacyUserCreateWithPassword) but no longer wired into the UI.

Every user-facing surface (top bar, sidebar, user management, audit
log, assignee pickers, dispute notifications) now shows full_name
instead of username, falling back to username when unset.

Also fixes long attack_procedure/expected_detection/suggested_text
text overflowing its container in the template review panels and
Red/Blue team fields (missing break-words on whitespace-pre-wrap
blocks).

backend/tests/test_password_setup_flow.py

@@ -0,0 +1,132 @@
+"""End-to-end coverage for the passwordless user creation + emailed
+set-password-link flow (also reused for password resets).
+"""
+
+import uuid
+from unittest.mock import patch
+
+import pytest
+
+
+@pytest.fixture
+def new_user_id(api, auth_headers):
+    resp = api(
+        "post", "/api/v1/users", auth_headers,
+        json={"full_name": "Set Password User", "email": "setpw@test.com", "role": "viewer"},
+    )
+    assert resp.status_code == 201, resp.text
+    return resp.json()["id"]
+
+
+def test_send_password_email_requires_webhook_configured(api, auth_headers, new_user_id):
+    resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+    assert resp.status_code == 400
+    assert "webhook" in resp.text.lower()
+
+
+def test_admin_can_configure_password_webhook(api, auth_headers):
+    resp = api(
+        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook"},
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["configured"] is True
+
+    get_resp = api("get", "/api/v1/system/password-webhook-config", auth_headers)
+    assert get_resp.json()["url"] == "https://example.com/power-automate-hook"
+
+
+def test_send_password_email_posts_to_webhook_and_issues_token(api, db, auth_headers, new_user_id):
+    api(
+        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook"},
+    )
+
+    with patch("app.services.password_setup_service.requests.post") as mock_post:
+        resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+    assert resp.status_code == 200, resp.text
+    mock_post.assert_called_once()
+    call_kwargs = mock_post.call_args
+    assert call_kwargs.args[0] == "https://example.com/power-automate-hook"
+    assert call_kwargs.kwargs["json"]["email"] == "setpw@test.com"
+    assert "token=" in call_kwargs.kwargs["json"]["set_password_url"]
+
+    from app.models.password_setup_token import PasswordSetupToken
+    token_row = db.query(PasswordSetupToken).filter(PasswordSetupToken.user_id == uuid.UUID(new_user_id)).first()
+    assert token_row is not None
+    assert token_row.used_at is None
+
+
+def test_set_password_with_valid_token_succeeds(api, db, auth_headers, new_user_id):
+    api(
+        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook"},
+    )
+    with patch("app.services.password_setup_service.requests.post"):
+        api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+
+    from app.models.password_setup_token import PasswordSetupToken
+    token_row = db.query(PasswordSetupToken).filter(PasswordSetupToken.user_id == uuid.UUID(new_user_id)).first()
+
+    validate = api("get", f"/api/v1/auth/set-password/validate?token={token_row.token}", {})
+    assert validate.status_code == 200
+    assert validate.json()["valid"] is True
+    assert validate.json()["full_name"] == "Set Password User"
+
+    resp = api(
+        "post", "/api/v1/auth/set-password", {},
+        json={"token": token_row.token, "new_password": "BrandNewPass123!@#"},
+    )
+    assert resp.status_code == 200, resp.text
+
+    login = api(
+        "post", "/api/v1/auth/login", {},
+        data={"username": "setpw@test.com", "password": "BrandNewPass123!@#"},
+    )
+    assert login.status_code == 200, login.text
+
+
+def test_set_password_token_cannot_be_reused(api, db, auth_headers, new_user_id):
+    api(
+        "patch", "/api/v1/system/password-webhook-config", auth_headers,
+        json={"url": "https://example.com/power-automate-hook"},
+    )
+    with patch("app.services.password_setup_service.requests.post"):
+        api("post", f"/api/v1/users/{new_user_id}/send-password-email", auth_headers)
+
+    from app.models.password_setup_token import PasswordSetupToken
+    token_row = db.query(PasswordSetupToken).filter(PasswordSetupToken.user_id == uuid.UUID(new_user_id)).first()
+
+    first = api(
+        "post", "/api/v1/auth/set-password", {},
+        json={"token": token_row.token, "new_password": "BrandNewPass123!@#"},
+    )
+    assert first.status_code == 200
+
+    second = api(
+        "post", "/api/v1/auth/set-password", {},
+        json={"token": token_row.token, "new_password": "AnotherPass456!@#"},
+    )
+    assert second.status_code == 400
+
+
+def test_set_password_invalid_token_rejected(api):
+    validate = api("get", "/api/v1/auth/set-password/validate?token=not-a-real-token", {})
+    assert validate.status_code == 200
+    assert validate.json()["valid"] is False
+
+    resp = api(
+        "post", "/api/v1/auth/set-password", {},
+        json={"token": "not-a-real-token", "new_password": "BrandNewPass123!@#"},
+    )
+    assert resp.status_code == 404
+
+
+def test_password_webhook_config_requires_admin(api, red_lead_headers):
+    resp = api("get", "/api/v1/system/password-webhook-config", red_lead_headers)
+    assert resp.status_code == 403
+
+
+def test_send_password_email_requires_admin(api, red_lead_headers, new_user_id):
+    resp = api("post", f"/api/v1/users/{new_user_id}/send-password-email", red_lead_headers)
+    assert resp.status_code == 403