Forgot password says what happened; set-up email for people with no account here - #464

Summary

A person copied over from hosted CoderHelm (on the install's team, no sign-in account here) pressed Forgot password. The user pool had no user for that email, so Cognito sent nothing, the page implied a code was coming, and they waited for an email that never existed.

Now, on a self-hosted install, forgot-password says what happened for that email and sends the set-up email to people who have no account yet. The sign-in page also names the sender to look for. Admins get a bulk send for everyone who hasn't set up an account.

Changes

• POST /auth/forgot-password (self-hosted) decides one of these cases with plan_forgot, and forgot_reply gives each one its own status and message:
  • code_sent: has an account here, so Cognito sends a code. "We sent a reset code to ."
  • setup_sent: on the team but no account here, so the existing set-up email goes. "You don't have an account here yet. We sent you a set-up link instead."
  • setup_recent: as setup_sent, but one already went within the hour (the same one an hour, five a week cap as the admin button).
  • invited: points at the invite email. Sends nothing.
  • no_account: "There's no account for on this CoderHelm. Ask an admin to add you." Sends nothing.
  • Limits: 10 an hour per IP and 5 an hour per email, both shared counters. The per-email key is a hash, so no addresses go into the counter table. These sit on top of the existing 20 per 5 minutes on the sign-in routes. The hosted service keeps its single answer for every email.
• GET /auth/methods (self-hosted) adds senders: {setup, reset_codes}:
  • setup is the install's SES address, or the relay's from address.
  • reset_codes is read from the user pool's EmailConfiguration: no-reply@verificationemail.com for COGNITO_DEFAULT, otherwise the pool's From address or SES identity.
  • Cached for 5 minutes per instance. The gateway role gets cognito-idp:DescribeUserPool on its own pool.
• POST /api/users/setup-emails (admins, people capability): sends the set-up email to everyone who needs one and skips anyone sent one in the last hour. Limited to 3 an hour per team. Returns the counts and when each email was sent.
• Set-up email delivery is now one function (deliver_setup_email), used by the row button, the bulk send and forgot-password.
• GET /api/users now sets needs_setup for every viewer on a self-hosted install, not only admins. That way nobody reads hosted activity as use of this install.
• Docs: sign-in.md explains the three ways to get the set-up email, the forgot-password cases and limits, and both senders.

Verification

• cargo fmt --check, cargo clippy -p gateway --all-targets -D warnings, cargo test -p gateway: 707 passed. The new tests:
  • a member with no account gets the set-up email
  • the hourly wait applies from the sign-in page too
  • a non-member, or a domain/listed/first-admin email, sends nothing
  • an account here always gets a reset code
  • an invite sends nothing
  • every case has a distinct status
  • the per-email counter key holds no address
  • the Cognito sender is resolved for default, From and SES-identity configs
  • the bulk send skips anyone emailed in the last hour
  • a self-service email stands on an owner, else an admin
  • the bulk route is in the permissions table
• infra: npm test, 145 passed.
• No email sent, nothing deployed.