feat(users): passwordless user creation via emailed set-password link, display full name instead of username

Admins now create users with a name + email (no password) and role;
a Send Email action (per-user, also reusable for resets) issues a
one-time token and POSTs it to an admin-configurable webhook URL —
intended for a Power Automate flow that delivers the actual email.
The old admin-sets-the-password flow is kept server-side
(LegacyUserCreateWithPassword) but no longer wired into the UI.

Every user-facing surface (top bar, sidebar, user management, audit
log, assignee pickers, dispute notifications) now shows full_name
instead of username, falling back to username when unset.

Also fixes long attack_procedure/expected_detection/suggested_text
text overflowing its container in the template review panels and
Red/Blue team fields (missing break-words on whitespace-pre-wrap
blocks).

backend/tests/test_user_api_validation.py

@@ -1,28 +1,30 @@
-"""API-level validation tests for user creation (SEC-004, SEC-007)."""
+"""API-level validation tests for user creation (SEC-004, SEC-007).
+
+Users are created with a name + email — no password (see
+password_setup_service for the emailed set-password link flow) and no
+admin-supplied username (username is auto-derived from email).
+"""
 
 
-def test_create_user_weak_password_rejected(client, admin_user, admin_token):
+def test_create_user_missing_full_name_rejected(client, admin_user, admin_token):
     response = client.post(
         "/api/v1/users",
         json={
-            "username": "newuser",
-            "password": "123",
+            "full_name": "",
             "email": "new@test.com",
             "role": "viewer",
         },
         headers={"Authorization": f"Bearer {admin_token}"},
     )
     assert response.status_code == 422
-    assert "password" in response.text.lower()
 
 
-def test_create_user_reserved_username(client, admin_user, admin_token):
+def test_create_user_invalid_email_rejected(client, admin_user, admin_token):
     response = client.post(
         "/api/v1/users",
         json={
-            "username": "system",
-            "password": "SecurePass123!@#",
-            "email": "sys@test.com",
+            "full_name": "New User",
+            "email": "not-an-email",
             "role": "viewer",
         },
         headers={"Authorization": f"Bearer {admin_token}"},
@@ -30,33 +32,21 @@ def test_create_user_reserved_username(client, admin_user, admin_token):
     assert response.status_code == 422
 
 
-def test_create_user_invalid_username_chars(client, admin_user, admin_token):
+def test_create_user_valid_request_accepted(client, admin_user, admin_token):
     response = client.post(
         "/api/v1/users",
         json={
-            "username": "../admin",
-            "password": "SecurePass123!@#",
-            "email": "bad@test.com",
-            "role": "viewer",
-        },
-        headers={"Authorization": f"Bearer {admin_token}"},
-    )
-    assert response.status_code == 422
-
-
-def test_create_user_valid_password_accepted(client, admin_user, admin_token):
-    response = client.post(
-        "/api/v1/users",
-        json={
-            "username": "validuser99",
-            "password": "ValidPass123!@#",
+            "full_name": "Valid User",
             "email": "valid@test.com",
             "role": "viewer",
         },
         headers={"Authorization": f"Bearer {admin_token}"},
     )
-    assert response.status_code == 201
-    assert response.json()["username"] == "validuser99"
+    assert response.status_code == 201, response.text
+    body = response.json()
+    assert body["full_name"] == "Valid User"
+    assert body["username"] == "valid@test.com"
+    assert body["must_change_password"] is True
 
 
 def test_create_user_with_manager_role_accepted(client, admin_user, admin_token):
@@ -65,8 +55,7 @@ def test_create_user_with_manager_role_accepted(client, admin_user, admin_token)
     response = client.post(
         "/api/v1/users",
         json={
-            "username": "newmanager",
-            "password": "ValidPass123!@#",
+            "full_name": "New Manager",
             "email": "newmanager@test.com",
             "role": "manager",
         },
@@ -80,8 +69,7 @@ def test_create_user_invalid_role_rejected(client, admin_user, admin_token):
     response = client.post(
         "/api/v1/users",
         json={
-            "username": "badroleuser",
-            "password": "ValidPass123!@#",
+            "full_name": "Bad Role User",
             "email": "badrole@test.com",
             "role": "superuser",
         },
@@ -89,3 +77,20 @@ def test_create_user_invalid_role_rejected(client, admin_user, admin_token):
     )
     assert response.status_code == 400
     assert "Invalid role" in response.text
+
+
+def test_create_user_duplicate_email_rejected(client, admin_user, admin_token):
+    payload = {
+        "full_name": "Dup User",
+        "email": "dup@test.com",
+        "role": "viewer",
+    }
+    first = client.post(
+        "/api/v1/users", json=payload, headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert first.status_code == 201, first.text
+
+    second = client.post(
+        "/api/v1/users", json=payload, headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert second.status_code == 409