refractor(auth): removed password from everywhere

2026-06-16 10:37:31 +02:00
parent 4f80d7f995
commit bb7ed18539
25 changed files with 69 additions and 454 deletions
@@ -29,12 +29,10 @@ public revocable link generated by operator/admin.

 ## Current Auth Model
 - Registration creates `citizen`.
- Login paths:
+- Login path:
  - OTP email via Mailpit
-  - password fallback
 - Auth token: bearer token from `api_tokens`
 - Banned users cannot authenticate.
- `must_change_password` blocks most protected operator/admin flows until changed.

 ## Current Report Workflow
 ### Citizen flow