feat(auth): support bootstrap signup fallback onboarding

Author: pRizz

README.md

@@ -155,8 +155,8 @@ occ start
 ```
 
 If this is the first startup with no configured managed users, the container logs will print an **Initial One-Time Password (IOTP)**.
-Open the login page, use the first-time setup panel, and enroll a passkey for the default `opencoder` account.
-The IOTP is invalidated after successful passkey enrollment.
+Open the login page, use the first-time setup panel, then continue to passkey setup where you can either enroll a passkey or choose username/password registration.
+The IOTP is invalidated after successful passkey enrollment or successful username/password bootstrap signup.
 Built-in image users (for example `ubuntu`/`opencoder`) do not count as configured users for IOTP bootstrap.
 
 Quick IOTP extraction from logs:
@@ -171,7 +171,7 @@ You can also run the setup wizard:
 occ setup
 ```
 
-The wizard now configures runtime settings (image source, bind/port, mounts), keeps authentication on IOTP + passkey onboarding, and attempts to auto-detect the IOTP from logs after start.
+The wizard now configures runtime settings (image source, bind/port, mounts), keeps authentication on IOTP-first onboarding, and attempts to auto-detect the IOTP from logs after start.
 
 ### From source (install locally)
 
@@ -370,8 +370,10 @@ First boot path:
 - Extract only the IOTP quickly: `occ logs | grep -F "INITIAL ONE-TIME PASSWORD (IOTP): " | tail -n1 | sed 's/.*INITIAL ONE-TIME PASSWORD (IOTP): //'`
 - `occ setup` attempts to auto-detect and print the IOTP after starting/restarting the service.
 - Enter that IOTP in the web login page first-time setup panel.
-- Enroll a passkey for the default `opencoder` account.
-- The IOTP is deleted after successful passkey enrollment.
+- Continue to passkey setup, then choose one of:
+  - Enroll a passkey for the default `opencoder` account, or
+  - Use the username/password fallback to create your first managed user.
+- The IOTP is deleted after successful passkey enrollment or successful username/password bootstrap signup.
 - To restart first-time onboarding after completion, run `occ reset iotp`.
 - Built-in image users (for example `ubuntu`/`opencoder`) do not disable IOTP bootstrap.
 

docs/deploy/digitalocean-droplet.md

@@ -89,9 +89,11 @@ If you used `occ setup`, it will also try to auto-detect and print the IOTP afte
 Open the web login page through your SSH tunnel and use the first-time setup panel:
 - Enter the IOTP from logs
 - Continue to passkey setup
-- Enroll a passkey for the default `opencoder` account
+- Then either:
+  - Enroll a passkey for the default `opencoder` account, or
+  - Use username/password fallback to create your first managed user
 
-The IOTP is invalidated after successful passkey enrollment.
+The IOTP is invalidated after successful passkey enrollment or successful username/password bootstrap signup.
 
 Admin fallback:
 
@@ -285,7 +287,7 @@ Extract only the IOTP value:
 docker logs opencode-cloud-sandbox 2>&1 | grep -F "INITIAL ONE-TIME PASSWORD (IOTP): " | tail -n1 | sed 's/.*INITIAL ONE-TIME PASSWORD (IOTP): //'
 ```
 
-Use the login page first-time setup panel with that IOTP, then enroll a passkey for `opencoder`.
+Use the login page first-time setup panel with that IOTP, then continue to passkey setup where you can either enroll a passkey for `opencoder` or choose username/password registration to create your first managed user.
 
 ### 5) Expose publicly (optional)
 

packages/cli-rust/src/commands/setup.rs

@@ -277,8 +277,7 @@ async fn maybe_print_iotp_info(client: &DockerClient, host: Option<&str>, config
             style(iotp).green().bold()
         );
         println!(
-            "Enter this in the web login first-time setup panel, then enroll a passkey for {}.",
-            style("opencoder").cyan()
+            "Enter this in the web login first-time setup panel, then choose passkey enrollment or username/password bootstrap signup.",
         );
         return;
     }

packages/core/README.md

@@ -155,8 +155,8 @@ occ start
 ```
 
 If this is the first startup with no configured managed users, the container logs will print an **Initial One-Time Password (IOTP)**.
-Open the login page, use the first-time setup panel, and enroll a passkey for the default `opencoder` account.
-The IOTP is invalidated after successful passkey enrollment.
+Open the login page, use the first-time setup panel, then continue to passkey setup where you can either enroll a passkey or choose username/password registration.
+The IOTP is invalidated after successful passkey enrollment or successful username/password bootstrap signup.
 Built-in image users (for example `ubuntu`/`opencoder`) do not count as configured users for IOTP bootstrap.
 
 Quick IOTP extraction from logs:
@@ -171,7 +171,7 @@ You can also run the setup wizard:
 occ setup
 ```
 
-The wizard now configures runtime settings (image source, bind/port, mounts), keeps authentication on IOTP + passkey onboarding, and attempts to auto-detect the IOTP from logs after start.
+The wizard now configures runtime settings (image source, bind/port, mounts), keeps authentication on IOTP-first onboarding, and attempts to auto-detect the IOTP from logs after start.
 
 ### From source (install locally)
 
@@ -370,8 +370,10 @@ First boot path:
 - Extract only the IOTP quickly: `occ logs | grep -F "INITIAL ONE-TIME PASSWORD (IOTP): " | tail -n1 | sed 's/.*INITIAL ONE-TIME PASSWORD (IOTP): //'`
 - `occ setup` attempts to auto-detect and print the IOTP after starting/restarting the service.
 - Enter that IOTP in the web login page first-time setup panel.
-- Enroll a passkey for the default `opencoder` account.
-- The IOTP is deleted after successful passkey enrollment.
+- Continue to passkey setup, then choose one of:
+  - Enroll a passkey for the default `opencoder` account, or
+  - Use the username/password fallback to create your first managed user.
+- The IOTP is deleted after successful passkey enrollment or successful username/password bootstrap signup.
 - To restart first-time onboarding after completion, run `occ reset iotp`.
 - Built-in image users (for example `ubuntu`/`opencoder`) do not disable IOTP bootstrap.