feat: add browser auth shell

2026-08-23 22:01:26 -05:00
parent 91aa9c2930
commit a8c7c50b4d
26 changed files with 2702 additions and 194 deletions
@@ -294,6 +294,13 @@ before the id is even parsed as a valid `EkklesiaUserId` — this command never
 signup order or "the only user in the database"; the operator must name the exact, opaque id
 twice.

+**The command grants authority; it does not create credentials.** Production public signup is
+prohibited, and the repository currently has no invitation flow or operator-owned user-creation
+command. A fresh production installation therefore has no supported path to create the initial
+identity this command requires. Development integration tests may enable signup, create a user,
+bootstrap that existing id, and prove its Dashboard session, but that is test composition — not a
+production first-user provisioning workflow. This gap must be closed before launch.
+
 ### Bootstrap is permanently single-use

 `core/src/authorization/bootstrap.ts`'s `bootstrapPlatformOwner(db, {userId})` is a dedicated,