Both account-creation surfaces now require the password twice:
- Web signup (invite-based self-service): SignupComplete gains a
password_confirm field with a model_validator backstop server-side,
plus a client-side match check in SignupPage.tsx for immediate
feedback -- the client check is the primary UX, the server check is
defense in depth so the guarantee doesn't rely on the client alone.
- CLI (python -m app.cli create-user): password is now an optional
positional argument. If omitted, prompts interactively via getpass
(hidden input) twice, retrying on mismatch -- matching what "entered
twice and verified" actually means for a human typing blind. Passing
the password directly as before still works unchanged, for scripted/
automated provisioning.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
