Add notify-creds subcommand to (re)email members git + mailbox creds

`agentbbs notify-creds` backfills credential emails to verified members
who signed up before the git/mailbox welcome emails existed.

- git (all verified): forgejo.EnsureUserReset resets each account to a
  fresh one-time password (must-change) and emails the web login link,
  username, and password. New method since the original one-time
  password is not recoverable for existing accounts.
- mailbox (all verified): ensures the forwardemail alias and emails the
  address + webmail link.
- Preview by default; --send executes. --git/--mail/--user filters.
  Refuses --send without SMTP; warns+skips when Forgejo/forwardemail
  are unconfigured.

Also folds in the welcome-email functions (gitWelcomeEmailBody,
mailWelcomeEmailBody, EnsureUser password return, provisionGit/
ensurePremium sends) that this builds on. README ops + forgejo tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/forgejo/forgejo.go

@@ -47,26 +47,34 @@ func ConfigFromEnv() Config {
 // Configured reports whether accounts can actually be provisioned.
 func (c Config) Configured() bool { return c.BaseURL != "" && c.Token != "" }
 
+// LoginURL is the web sign-in page members are pointed at in their welcome
+// email, e.g. https://git.profullstack.com/user/login.
+func (c Config) LoginURL() string {
+	return strings.TrimRight(c.BaseURL, "/") + "/user/login"
+}
+
 // EnsureUser creates a Forgejo account for username (forwarding to email) if it
-// does not already exist. It is idempotent: created is false when the account
-// was already present. New accounts are created with must_change_password — git
-// access is via SSH keys, so the generated password is never used interactively.
-func (c Config) EnsureUser(username, email string) (created bool, err error) {
+// does not already exist. It is idempotent: created is false (and password "")
+// when the account was already present. New accounts get a generated temporary
+// password with must_change_password set; the caller emails it to the member so
+// they can sign in to the web UI once and set their own. Git over SSH still uses
+// their registered key.
+func (c Config) EnsureUser(username, email string) (created bool, password string, err error) {
 	if !c.Configured() {
-		return false, fmt.Errorf("forgejo not configured")
+		return false, "", fmt.Errorf("forgejo not configured")
 	}
 
 	exists, err := c.userExists(username)
 	if err != nil {
-		return false, err
+		return false, "", err
 	}
 	if exists {
-		return false, nil
+		return false, "", nil
 	}
 
 	pw, err := randomPassword()
 	if err != nil {
-		return false, err
+		return false, "", err
 	}
 	body, _ := json.Marshal(map[string]any{
 		"username":             username,
@@ -76,12 +84,62 @@ func (c Config) EnsureUser(username, email string) (created bool, err error) {
 	})
 	status, resp, err := c.do(http.MethodPost, "/admin/users", body)
 	if err != nil {
-		return false, err
+		return false, "", err
 	}
 	if status < 200 || status >= 300 {
-		return false, fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200))
+		return false, "", fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200))
 	}
-	return true, nil
+	return true, pw, nil
+}
+
+// EnsureUserReset creates the account if missing, or resets an existing
+// account's password to a fresh temporary one with must_change_password set.
+// Unlike EnsureUser it always returns a usable password — even for accounts
+// that already exist (whose original one-time password we no longer hold).
+// created reports whether the account was newly made. Used by the notify-creds
+// re-send so every member receives working web credentials.
+func (c Config) EnsureUserReset(username, email string) (created bool, password string, err error) {
+	if !c.Configured() {
+		return false, "", fmt.Errorf("forgejo not configured")
+	}
+	exists, err := c.userExists(username)
+	if err != nil {
+		return false, "", err
+	}
+	pw, err := randomPassword()
+	if err != nil {
+		return false, "", err
+	}
+	if !exists {
+		body, _ := json.Marshal(map[string]any{
+			"username":             username,
+			"email":                email,
+			"password":             pw,
+			"must_change_password": true,
+		})
+		status, resp, err := c.do(http.MethodPost, "/admin/users", body)
+		if err != nil {
+			return false, "", err
+		}
+		if status < 200 || status >= 300 {
+			return false, "", fmt.Errorf("forgejo create user %q: %d: %s", username, status, truncate(resp, 200))
+		}
+		return true, pw, nil
+	}
+	// Reset the existing account's password. login_name/source_id are optional
+	// for local accounts in current Forgejo, so we send only the fields we change.
+	body, _ := json.Marshal(map[string]any{
+		"password":             pw,
+		"must_change_password": true,
+	})
+	status, resp, err := c.do(http.MethodPatch, "/admin/users/"+username, body)
+	if err != nil {
+		return false, "", err
+	}
+	if status < 200 || status >= 300 {
+		return false, "", fmt.Errorf("forgejo reset user %q: %d: %s", username, status, truncate(resp, 200))
+	}
+	return false, pw, nil
 }
 
 // userExists reports whether a Forgejo user with this name is present.

internal/forgejo/forgejo_test.go

@@ -20,7 +20,7 @@ func TestConfiguredRequiresURLAndToken(t *testing.T) {
 }
 
 func TestEnsureUserNoOpWhenUnconfigured(t *testing.T) {
-	if _, err := (Config{}).EnsureUser("alice", "a@x.com"); err == nil {
+	if _, _, err := (Config{}).EnsureUser("alice", "a@x.com"); err == nil {
 		t.Fatal("expected error when unconfigured")
 	}
 }
@@ -52,13 +52,19 @@ func TestEnsureUserCreatesWhenMissing(t *testing.T) {
 	defer srv.Close()
 
 	c := Config{BaseURL: srv.URL, Token: "secret"}
-	created, err := c.EnsureUser("alice", "a@x.com")
+	created, password, err := c.EnsureUser("alice", "a@x.com")
 	if err != nil {
 		t.Fatalf("EnsureUser: %v", err)
 	}
 	if !created {
 		t.Fatal("expected created=true")
 	}
+	if password == "" {
+		t.Fatal("expected a generated temporary password for a new account")
+	}
+	if password != got.body["password"] {
+		t.Errorf("returned password %q does not match the one sent to forgejo %v", password, got.body["password"])
+	}
 	if !got.lookup || !got.create {
 		t.Fatalf("expected lookup+create, got %+v", got)
 	}
@@ -70,6 +76,78 @@ func TestEnsureUserCreatesWhenMissing(t *testing.T) {
 	}
 }
 
+func TestEnsureUserResetCreatesWhenMissing(t *testing.T) {
+	var posted bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/api/v1/users/alice":
+			w.WriteHeader(http.StatusNotFound)
+		case r.Method == http.MethodPost && r.URL.Path == "/api/v1/admin/users":
+			posted = true
+			w.WriteHeader(http.StatusCreated)
+			_, _ = w.Write([]byte(`{"id":1}`))
+		default:
+			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
+			w.WriteHeader(http.StatusTeapot)
+		}
+	}))
+	defer srv.Close()
+
+	c := Config{BaseURL: srv.URL, Token: "secret"}
+	created, password, err := c.EnsureUserReset("alice", "a@x.com")
+	if err != nil {
+		t.Fatalf("EnsureUserReset: %v", err)
+	}
+	if !created || password == "" || !posted {
+		t.Fatalf("expected created+password+POST, got created=%v pw=%q posted=%v", created, password, posted)
+	}
+}
+
+func TestEnsureUserResetPatchesWhenExists(t *testing.T) {
+	var patched bool
+	var body map[string]any
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/api/v1/users/alice":
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(`{"id":1}`))
+		case r.Method == http.MethodPatch && r.URL.Path == "/api/v1/admin/users/alice":
+			patched = true
+			_ = json.NewDecoder(r.Body).Decode(&body)
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(`{"id":1}`))
+		case r.Method == http.MethodPost:
+			t.Error("must not create when the account already exists")
+			w.WriteHeader(http.StatusTeapot)
+		default:
+			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
+			w.WriteHeader(http.StatusTeapot)
+		}
+	}))
+	defer srv.Close()
+
+	c := Config{BaseURL: srv.URL, Token: "secret"}
+	created, password, err := c.EnsureUserReset("alice", "a@x.com")
+	if err != nil {
+		t.Fatalf("EnsureUserReset: %v", err)
+	}
+	if created {
+		t.Fatal("expected created=false for existing account")
+	}
+	if password == "" {
+		t.Fatal("expected a fresh password even for an existing account")
+	}
+	if !patched {
+		t.Fatal("expected a PATCH to reset the password")
+	}
+	if body["password"] != password {
+		t.Errorf("returned password %q does not match the one sent %v", password, body["password"])
+	}
+	if body["must_change_password"] != true {
+		t.Errorf("expected must_change_password=true, got %v", body["must_change_password"])
+	}
+}
+
 func TestEnsureUserNoOpWhenExists(t *testing.T) {
 	created := false
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -82,13 +160,16 @@ func TestEnsureUserNoOpWhenExists(t *testing.T) {
 	defer srv.Close()
 
 	c := Config{BaseURL: srv.URL, Token: "secret"}
-	got, err := c.EnsureUser("alice", "a@x.com")
+	got, password, err := c.EnsureUser("alice", "a@x.com")
 	if err != nil {
 		t.Fatalf("EnsureUser: %v", err)
 	}
 	if got {
 		t.Fatal("expected created=false for existing user")
 	}
+	if password != "" {
+		t.Fatal("expected empty password when account already exists")
+	}
 	if created {
 		t.Fatal("must not POST when the user already exists")
 	}