feat: self-service sign-up with email verification and onboarding

Complete sign-up pipeline: email registration via Logto Experience API,
SMTP email verification, and self-service trial tenant creation.

Layer 1 — Logto config:
- Bootstrap Phase 8b: SMTP email connector with branded HTML templates
- Bootstrap Phase 8c: enable SignInAndRegister (email+password sign-up)
- Dockerfile installs official Logto connectors (ensures SMTP available)
- SMTP env vars in docker-compose, installer templates, .env.example

Layer 2 — Experience API (ui/sign-in/experience-api.ts):
- Registration flow: initRegistration → sendVerificationCode → verifyCode
  → addProfile (password) → identifyUser → submit
- Sign-in auto-detects email vs username identifier

Layer 3 — Custom sign-in UI (ui/sign-in/SignInPage.tsx):
- Three-mode state machine: signIn / register / verifyCode
- Reads first_screen=register from URL query params
- Toggle links between sign-in and register views

Layer 4 — Post-registration onboarding:
- OnboardingService: reuses VendorTenantService.createAndProvision(),
  adds calling user to Logto org as owner, enforces one trial per user
- OnboardingController: POST /api/onboarding/tenant (authenticated only)
- OnboardingPage.tsx: org name + auto-slug form
- LandingRedirect: detects zero orgs → redirects to /onboarding
- RegisterPage.tsx: /platform/register initiates OIDC with firstScreen

Installers (install.sh + install.ps1):
- Both prompt for SMTP config in SaaS mode
- CLI args, env var capture, cameleer.conf persistence

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

installer/install.ps1

@@ -37,6 +37,11 @@ param(
     [string]$DockerSocket,
     [string]$NodeTlsReject,
     [string]$DeploymentMode,
+    [string]$SmtpHost,
+    [string]$SmtpPort,
+    [string]$SmtpUser,
+    [string]$SmtpPass,
+    [string]$SmtpFromEmail,
     [switch]$Reconfigure,
     [switch]$Reinstall,
     [switch]$ConfirmDestroy,
@@ -84,6 +89,11 @@ $_ENV_COMPOSE_PROJECT       = $env:COMPOSE_PROJECT
 $_ENV_DOCKER_SOCKET         = $env:DOCKER_SOCKET
 $_ENV_NODE_TLS_REJECT       = $env:NODE_TLS_REJECT
 $_ENV_DEPLOYMENT_MODE       = $env:DEPLOYMENT_MODE
+$_ENV_SMTP_HOST             = $env:SMTP_HOST
+$_ENV_SMTP_PORT             = $env:SMTP_PORT
+$_ENV_SMTP_USER             = $env:SMTP_USER
+$_ENV_SMTP_PASS             = $env:SMTP_PASS
+$_ENV_SMTP_FROM_EMAIL       = $env:SMTP_FROM_EMAIL
 
 # --- Mutable config state ---
 
@@ -110,6 +120,11 @@ $script:cfg = @{
     DockerSocket        = $DockerSocket
     NodeTlsReject       = $NodeTlsReject
     DeploymentMode      = $DeploymentMode
+    SmtpHost            = $SmtpHost
+    SmtpPort            = $SmtpPort
+    SmtpUser            = $SmtpUser
+    SmtpPass            = $SmtpPass
+    SmtpFromEmail       = $SmtpFromEmail
 }
 
 if ($Silent)      { $script:Mode = 'silent' }
@@ -260,6 +275,11 @@ function Load-ConfigFile {
                 'docker_socket'         { if (-not $script:cfg.DockerSocket)         { $script:cfg.DockerSocket         = $val } }
                 'node_tls_reject'       { if (-not $script:cfg.NodeTlsReject)        { $script:cfg.NodeTlsReject        = $val } }
                 'deployment_mode'       { if (-not $script:cfg.DeploymentMode)       { $script:cfg.DeploymentMode       = $val } }
+                'smtp_host'             { if (-not $script:cfg.SmtpHost)             { $script:cfg.SmtpHost             = $val } }
+                'smtp_port'             { if (-not $script:cfg.SmtpPort)             { $script:cfg.SmtpPort             = $val } }
+                'smtp_user'             { if (-not $script:cfg.SmtpUser)             { $script:cfg.SmtpUser             = $val } }
+                'smtp_pass'             { if (-not $script:cfg.SmtpPass)             { $script:cfg.SmtpPass             = $val } }
+                'smtp_from_email'       { if (-not $script:cfg.SmtpFromEmail)        { $script:cfg.SmtpFromEmail        = $val } }
             }
         }
     }
@@ -289,6 +309,11 @@ function Load-EnvOverrides {
     if (-not $c.DockerSocket)        { $c.DockerSocket        = $_ENV_DOCKER_SOCKET }
     if (-not $c.NodeTlsReject)       { $c.NodeTlsReject       = $_ENV_NODE_TLS_REJECT }
     if (-not $c.DeploymentMode)      { $c.DeploymentMode      = $_ENV_DEPLOYMENT_MODE }
+    if (-not $c.SmtpHost)            { $c.SmtpHost            = $_ENV_SMTP_HOST }
+    if (-not $c.SmtpPort)            { $c.SmtpPort            = $_ENV_SMTP_PORT }
+    if (-not $c.SmtpUser)            { $c.SmtpUser            = $_ENV_SMTP_USER }
+    if (-not $c.SmtpPass)            { $c.SmtpPass            = $_ENV_SMTP_PASS }
+    if (-not $c.SmtpFromEmail)       { $c.SmtpFromEmail       = $_ENV_SMTP_FROM_EMAIL }
 }
  
 # --- Prerequisites ---
@@ -447,6 +472,18 @@ function Run-SimplePrompts {
     Write-Host ''
     $deployChoice = Read-Host '  Select mode [1]'
     if ($deployChoice -eq '2') { $c.DeploymentMode = 'standalone' } else { $c.DeploymentMode = 'saas' }
+
+    # SMTP for email verification (SaaS mode only)
+    if ($c.DeploymentMode -eq 'saas') {
+        Write-Host ''
+        if (Prompt-YesNo 'Configure SMTP for email verification? (required for self-service sign-up)') {
+            $c.SmtpHost      = Prompt-Value 'SMTP host' (Coalesce $c.SmtpHost '')
+            $c.SmtpPort      = Prompt-Value 'SMTP port' (Coalesce $c.SmtpPort '587')
+            $c.SmtpUser      = Prompt-Value 'SMTP username' (Coalesce $c.SmtpUser '')
+            $c.SmtpPass      = Prompt-Password 'SMTP password' (Coalesce $c.SmtpPass '')
+            $c.SmtpFromEmail = Prompt-Value 'From email address' (Coalesce $c.SmtpFromEmail "noreply@$($c.PublicHost)")
+        }
+    }
 }
  
 function Run-ExpertPrompts {
@@ -688,6 +725,13 @@ CAMELEER_SAAS_PROVISIONING_RUNTIMEBASEIMAGE=${REGISTRY}/cameleer-runtime-base:$(
 
 # JWT signing secret (forwarded to provisioned tenant servers, must be non-empty)
 CAMELEER_SERVER_SECURITY_JWTSECRET=$jwtSecret
+
+# SMTP (for email verification during registration)
+SMTP_HOST=$($c.SmtpHost)
+SMTP_PORT=$(if ($c.SmtpPort) { $c.SmtpPort } else { '587' })
+SMTP_USER=$($c.SmtpUser)
+SMTP_PASS=$($c.SmtpPass)
+SMTP_FROM_EMAIL=$(if ($c.SmtpFromEmail) { $c.SmtpFromEmail } else { "noreply@$($c.PublicHost)" })
 "@
         $content += $provisioningBlock
         $composeFile = 'docker-compose.yml;docker-compose.saas.yml'
@@ -915,6 +959,11 @@ compose_project=$($c.ComposeProject)
 docker_socket=$($c.DockerSocket)
 node_tls_reject=$($c.NodeTlsReject)
 deployment_mode=$($c.DeploymentMode)
+smtp_host=$($c.SmtpHost)
+smtp_port=$($c.SmtpPort)
+smtp_user=$($c.SmtpUser)
+smtp_pass=$($c.SmtpPass)
+smtp_from_email=$($c.SmtpFromEmail)
 "@
     Write-Utf8File $f $txt
     Log-Info 'Saved installer config to cameleer.conf'