feat(console): improve user and project onboarding

[dviejokfs]

Summary

• add a dedicated user-creation flow with exact role permissions, random compliant passwords, first-login password reset, and optional team membership
• enforce secure first-login and MFA enrollment, including complete recovery-code delivery and server-side identity validation
• add project setup guidance for analytics, error tracking, domains, uptime, environment variables, and OpenTelemetry
• improve Drop and project uploads with automatic preset detection, preset logos, multiple-candidate selection, environment variables, cancellation, and error states
• persist and display deployment elapsed time across running and terminal states

Security

• reject unknown, empty, and duplicate user roles
• create users and role assignments in one transaction
• prevent enabled MFA credentials from being replaced without verified disablement
• rotate the complete unverified MFA bundle on retry and prevent activation when recovery codes were not delivered
• normalize and validate names and email addresses on the backend
• keep the raw MFA-disable operation private behind current-factor verification

An independent security re-audit of the final diff returned APPROVE.

Verification

• cargo check --lib
• cargo clippy --lib -- -D warnings
• targeted temps-auth regression tests for user creation, role transactions, MFA replacement, retry recovery codes, and MFA disablement
• bun run lint
• bun test src — 144 passed
• manual browser verification of exact role permissions, compliant random passwords, multi-preset Drop cards, masked environment variables, and all six project setup items

Notes

• the project setup destination remains accessible from the project setup card and is intentionally not duplicated in the main sidebar item list
• recovery codes are shown before MFA can be enabled in both enrollment surfaces

[github-actions]

📓 Changelog preview

This is what your commits will add to the generated CHANGELOG.md at release time (via git-cliff). Do not edit CHANGELOG.md by hand — it is generated from your Conventional Commit messages.

## [Unreleased]

### Added

- **console:** Improve user and project onboarding

### Fixed

- **ci:** Use beta sandbox image in deployment tests
- **console:** Resolve onboarding review findings
- **auth:** Await password reset transaction rollbacks
- **auth:** Await MFA challenge transaction rollbacks