feat: self-service sign-up with email verification and onboarding

Complete sign-up pipeline: email registration via Logto Experience API,
SMTP email verification, and self-service trial tenant creation.

Layer 1 — Logto config:
- Bootstrap Phase 8b: SMTP email connector with branded HTML templates
- Bootstrap Phase 8c: enable SignInAndRegister (email+password sign-up)
- Dockerfile installs official Logto connectors (ensures SMTP available)
- SMTP env vars in docker-compose, installer templates, .env.example

Layer 2 — Experience API (ui/sign-in/experience-api.ts):
- Registration flow: initRegistration → sendVerificationCode → verifyCode
  → addProfile (password) → identifyUser → submit
- Sign-in auto-detects email vs username identifier

Layer 3 — Custom sign-in UI (ui/sign-in/SignInPage.tsx):
- Three-mode state machine: signIn / register / verifyCode
- Reads first_screen=register from URL query params
- Toggle links between sign-in and register views

Layer 4 — Post-registration onboarding:
- OnboardingService: reuses VendorTenantService.createAndProvision(),
  adds calling user to Logto org as owner, enforces one trial per user
- OnboardingController: POST /api/onboarding/tenant (authenticated only)
- OnboardingPage.tsx: org name + auto-slug form
- LandingRedirect: detects zero orgs → redirects to /onboarding
- RegisterPage.tsx: /platform/register initiates OIDC with firstScreen

Installers (install.sh + install.ps1):
- Both prompt for SMTP config in SaaS mode
- CLI args, env var capture, cameleer.conf persistence

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

installer/install.sh

@@ -46,6 +46,11 @@ _ENV_COMPOSE_PROJECT="${COMPOSE_PROJECT:-}"
 _ENV_DOCKER_SOCKET="${DOCKER_SOCKET:-}"
 _ENV_NODE_TLS_REJECT="${NODE_TLS_REJECT:-}"
 _ENV_DEPLOYMENT_MODE="${DEPLOYMENT_MODE:-}"
+_ENV_SMTP_HOST="${SMTP_HOST:-}"
+_ENV_SMTP_PORT="${SMTP_PORT:-}"
+_ENV_SMTP_USER="${SMTP_USER:-}"
+_ENV_SMTP_PASS="${SMTP_PASS:-}"
+_ENV_SMTP_FROM_EMAIL="${SMTP_FROM_EMAIL:-}"
 
 INSTALL_DIR=""
 PUBLIC_HOST=""
@@ -69,6 +74,11 @@ COMPOSE_PROJECT=""
 DOCKER_SOCKET=""
 NODE_TLS_REJECT=""
 DEPLOYMENT_MODE=""
+SMTP_HOST=""
+SMTP_PORT=""
+SMTP_USER=""
+SMTP_PASS=""
+SMTP_FROM_EMAIL=""
 
 # --- State ---
 MODE=""  # simple, expert, silent
@@ -170,6 +180,11 @@ parse_args() {
       --docker-socket)    DOCKER_SOCKET="$2"; shift ;;
       --node-tls-reject)  NODE_TLS_REJECT="$2"; shift ;;
       --deployment-mode)  DEPLOYMENT_MODE="$2"; shift ;;
+      --smtp-host)         SMTP_HOST="$2"; shift ;;
+      --smtp-port)         SMTP_PORT="$2"; shift ;;
+      --smtp-user)         SMTP_USER="$2"; shift ;;
+      --smtp-pass)         SMTP_PASS="$2"; shift ;;
+      --smtp-from-email)   SMTP_FROM_EMAIL="$2"; shift ;;
       --server-admin-user)     ADMIN_USER="$2"; shift ;;
       --server-admin-password) ADMIN_PASS="$2"; shift ;;
       --reconfigure)      RERUN_ACTION="reconfigure" ;;
@@ -255,6 +270,11 @@ load_config_file() {
       docker_socket)        [ -z "$DOCKER_SOCKET" ] && DOCKER_SOCKET="$value" ;;
       node_tls_reject)      [ -z "$NODE_TLS_REJECT" ] && NODE_TLS_REJECT="$value" ;;
       deployment_mode)      [ -z "$DEPLOYMENT_MODE" ] && DEPLOYMENT_MODE="$value" ;;
+      smtp_host)            [ -z "$SMTP_HOST" ] && SMTP_HOST="$value" ;;
+      smtp_port)            [ -z "$SMTP_PORT" ] && SMTP_PORT="$value" ;;
+      smtp_user)            [ -z "$SMTP_USER" ] && SMTP_USER="$value" ;;
+      smtp_pass)            [ -z "$SMTP_PASS" ] && SMTP_PASS="$value" ;;
+      smtp_from_email)      [ -z "$SMTP_FROM_EMAIL" ] && SMTP_FROM_EMAIL="$value" ;;
     esac
   done < "$file"
 }
@@ -282,6 +302,11 @@ load_env_overrides() {
   [ -z "$DOCKER_SOCKET" ] && DOCKER_SOCKET="$_ENV_DOCKER_SOCKET"
   [ -z "$NODE_TLS_REJECT" ] && NODE_TLS_REJECT="$_ENV_NODE_TLS_REJECT"
   [ -z "$DEPLOYMENT_MODE" ] && DEPLOYMENT_MODE="$_ENV_DEPLOYMENT_MODE"
+  [ -z "$SMTP_HOST" ] && SMTP_HOST="$_ENV_SMTP_HOST"
+  [ -z "$SMTP_PORT" ] && SMTP_PORT="$_ENV_SMTP_PORT"
+  [ -z "$SMTP_USER" ] && SMTP_USER="$_ENV_SMTP_USER"
+  [ -z "$SMTP_PASS" ] && SMTP_PASS="$_ENV_SMTP_PASS"
+  [ -z "$SMTP_FROM_EMAIL" ] && SMTP_FROM_EMAIL="$_ENV_SMTP_FROM_EMAIL"
 }
 
 # --- Prerequisites ---
@@ -434,6 +459,18 @@ run_simple_prompts() {
       DEPLOYMENT_MODE="saas"
       ;;
   esac
+
+  # SMTP for email verification (SaaS mode only)
+  if [ "$DEPLOYMENT_MODE" = "saas" ]; then
+    echo ""
+    if prompt_yesno "Configure SMTP for email verification? (required for self-service sign-up)"; then
+      prompt SMTP_HOST "SMTP host" "${SMTP_HOST:-}"
+      prompt SMTP_PORT "SMTP port" "${SMTP_PORT:-587}"
+      prompt SMTP_USER "SMTP username" "${SMTP_USER:-}"
+      prompt_password SMTP_PASS "SMTP password" "${SMTP_PASS:-}"
+      prompt SMTP_FROM_EMAIL "From email address" "${SMTP_FROM_EMAIL:-noreply@${PUBLIC_HOST}}"
+    fi
+  fi
 }
 
 run_expert_prompts() {
@@ -696,6 +733,13 @@ CAMELEER_SAAS_PROVISIONING_RUNTIMEBASEIMAGE=${REGISTRY}/cameleer-runtime-base:${
 # JWT signing secret (forwarded to provisioned tenant servers, must be non-empty)
 CAMELEER_SERVER_SECURITY_JWTSECRET=$(generate_password)
 
+# SMTP (for email verification during registration)
+SMTP_HOST=${SMTP_HOST}
+SMTP_PORT=${SMTP_PORT:-587}
+SMTP_USER=${SMTP_USER}
+SMTP_PASS=${SMTP_PASS}
+SMTP_FROM_EMAIL=${SMTP_FROM_EMAIL:-noreply@${PUBLIC_HOST}}
+
 # Compose file assembly
 COMPOSE_FILE=docker-compose.yml:docker-compose.saas.yml$([ "$TLS_MODE" = "custom" ] && echo ":docker-compose.tls.yml")$([ -n "$MONITORING_NETWORK" ] && echo ":docker-compose.monitoring.yml")
 EOF
@@ -867,6 +911,11 @@ compose_project=${COMPOSE_PROJECT}
 docker_socket=${DOCKER_SOCKET}
 node_tls_reject=${NODE_TLS_REJECT}
 deployment_mode=${DEPLOYMENT_MODE}
+smtp_host=${SMTP_HOST}
+smtp_port=${SMTP_PORT}
+smtp_user=${SMTP_USER}
+smtp_pass=${SMTP_PASS}
+smtp_from_email=${SMTP_FROM_EMAIL}
 EOF
   log_info "Saved installer config to cameleer.conf"
 }