docs(auth): rewrite the access rules for the temporary password

[MendesMat]

No issue: this is stage 2 of the simplification plan (documentation only).

What

Rewrites the access rules in docs/product/ for the temporary password of decision 21, removes the text of the old plan about activation links and e-mail, and replaces the 54 ADR-00xx citations left in docs/ by the matching decision of docs/decisoes-de-arquitetura.md. In the code, only comments change.

Why

Decision 21 (2026-10-05) says a registered user gets a temporary password with a mandatory change, and the Admin is the demo account with a fixed password. AUTH-14, AUTH-15 and USR-34 still said the opposite. The owner decided the open points on 2026-10-07:

• the pending status and activatedAt leave the user record;
• a forgotten password is reset by someone with the Manager level on Usuários;
• change-password stays only for the account with a mandatory change;
• the e-mail becomes optional.

Rules that changed meaning

ID	Now says
AUTH-01	Whoever registers sets a temporary password; it stops being valid at the first sign-in
AUTH-02	A new user is created active, with a temporary password and a mandatory change
AUTH-13	The Admin is the demo account: admin / admin123, fixed and shown on the sign-in screen
AUTH-14	The mandatory change applies to every account with a temporary password, never to the Admin
AUTH-15	The Admin has no mandatory change and cannot change its password
AUTH-20	Passwords only in the body, the refresh token only in its cookie; never in the URL or in logs
AUTH-21	Deactivating a user ends their sessions (no links to invalidate)
AUTH-24	Same refusal, new message: "…fale com o responsável pelo sistema."
AUTH-25	New message: "…diferente da senha temporária."
USR-07	The e-mail is optional; valid format when filled in
USR-18	Reactivating always gives active, with the password the person had
USR-20	Filter options: "Ativos" (default), "Só desativados", "Todos"
USR-24	Only the Admin's e-mail comes from the configuration
PERM-03 (table)	"Resend access" (Editor) is replaced by "reset a user's password" (Manager)

Rules retired

AUTH-03, AUTH-04, AUTH-05, AUTH-06, AUTH-10, AUTH-11, AUTH-12, AUTH-23, USR-32, USR-34.

New rules

AUTH-29 (password reset by a Manager), USR-35 (temporaryPassword when registering) and USR-36 (the signature is stored in the user's record; resolves OQ-01).

Text only

AUTH-16, AUTH-19, USR-17, PERM-11, PERM-20, API-04, and the citations in AUTH-17, USR-16, USR-23, USR-25, PERM-13, PERM-22, PERM-24, CNV-04, CNV-09, CNV-10, CNV-12, API-01, API-06, API-07, API-12.

Contract changes written in the documents, not built

• Removed: checkLink, activateAccount, requestPasswordReset, resetPassword (by link), resendAccess, the field emailSent, the field activatedAt, the status pending, and the codes link_invalid, not_pending, email_missing.
• Added: temporaryPassword in createUser, and POST /api/v1/users/{id}/reset-password.
• Changed: the list filter status accepts active, inactive or all.

ADR citations

Old ADR	Now
0003, 0004, 0005, 0006, 0009	decisions 4, 9, 2, 3, 7
0011, 0012, 0014, 0015, 0016, 0017	decisions 10, 12, 13, 14, 15, 17
0019	decisions 18, 19 and 20, according to the sentence
0020, 0021, 0022, 0023	decisions 24, 25, 16, 22
0032	decisions 20 and 24
0018 (signature in object storage)	"O que ficou de fora"; OQ-01 resolved as a column in the database (USR-36)
0030, 0031 (e-mails)	removed together with the sentence

Code and tests tied to each changed rule

Comments changed in this pull request; the behavior is listed for the M1 issues and was not changed.

Rule	Code and tests	Behavior left for the M1 issues
AUTH-02, AUTH-23, USR-18, USR-20 (no pending)	User.Create, User.Activate, User.Reactivate, UserStatus.Pending; UserTests (7 tests), SignInTests.Pending_account_…, AuthTestBed.AddPendingUser, UserPersistenceTests; Activate used as set-up in AuthTestSupport, AuditFieldsPersistenceTests, ConcurrencyPersistenceTests, UnitOfWorkPersistenceTests	Create users as active, remove Activate and Pending, with a migration
USR-32, USR-34 (no activatedAt)	User.ActivatedAt, User.CompleteFirstAccess, ChangePasswordHandler; UserTests (3 tests), ChangePasswordTests.Changing_the_initial_password_…, AdminFirstAccessApiTests, StartupSeedTests, AuthTestSupport.ResetAdminAsync	Remove the property and the column
AUTH-13, AUTH-15, USR-24 (Admin demo account)	AdminOptions.InitialPassword, SystemRecordsSeeder, DependencyInjection (start-up validation), ControlService.API.http; AdminCredentialTests, AdminFirstAccessApiTests, ApiFactory, AuthTestBed.AddAdminWithInitialPassword	Seed the Admin with the fixed password and without a mandatory change; remove Admin:InitialPassword
AUTH-14 (mandatory change for registered users)	PasswordChangeRequiredFilter, ApiV1Group, ICredentialStore, UserCredential; SignInTests, RefreshSessionTests, AdminFirstAccessApiTests	The mechanism stays; the tests move from the Admin to a registered user. Message text changes in AuthErrors.PasswordChangeRequired
AUTH-24, AUTH-25 (messages)	AuthErrors.PasswordAlreadyCreated, AuthErrors.NewPasswordEqualsInitial; ChangePasswordTests, AdminFirstAccessApiTests	Two message texts
USR-07 (optional e-mail)	EmailAddress, User.Email; EmailAddressTests, UserTests	Accept an empty e-mail, remove the "link de ativação" message, migration if the column is not nullable
Retired error codes	ErrorStatusCodes (link_invalid, not_pending, email_missing); ErrorResultsTests	Remove the three entries
AUTH-29, USR-35 (new)	none yet	Built with the users endpoints (#11)

Tests that still prove the previous plan no longer cite a rule that says the opposite: their comment says "previous plan, see decision 21".

Tests

Documentation and comments only, so there is no numbered list. check.ps1: build with 0 warnings, 243 of 243 test cases passed.

How to test

Read docs/product/features/authentication.md and users.md against decision 21. grep -rn "ADR-" docs README.md returns nothing.

Still pointing to something that does not exist

• The code listed in the table above (status pending, activatedAt, activation, the messages with "Esqueci minha senha", "senha inicial" and "link de ativação", Admin:InitialPassword, three error codes).
• Mailpit and NSubstitute in README.md, backend/ControlService/README.md, docs/agents/guides/local-environment.md and AppHost.cs: still true of the code until Remove the leftovers of the old plan (unused packages, Mailpit, template extras) #34.
• docs/frontend/ describes a prototype whose access screens follow the e-mail model; the differences table lists what changes when it joins the repository.
• The bodies of issues Enforce per-screen authorization and check the account on every request #9, Add the permission profile and screen catalog endpoints #10 and Users endpoints with a temporary password #11 still mention the old plan; Future: account activation and password reset by e-mail #12 is the postponed e-mail access itself.

Checklist

• Developed test-first: not applicable, no behavior changed
• check.ps1 passes locally: build without warnings and all tests
• Nothing beyond the scope: no package, abstraction, migration or code behavior changed
• Documentation updated (docs/, README)
• User-facing messages are the ones the owner approved on 2026-10-07 (CNV-16)