docs(admin/occ): complete user & group command documentation

[miaulalala]

Add missing commands:

• user:auth-tokens:add/delete/list — app password management
• user:clear-avatar-cache — clear cached avatars
• user:keys:verify — verify E2E encryption key pair
• user:list — expanded with options (--disabled, --info, pagination)
• user:info — rewritten with accurate output example
• user:sync-account-data — sync backend data to accounts table
• user:welcome — send welcome email with optional password reset link
• group:info — show group details and backend
• group:list — add searchstring argument and output options
• twofactorauth:enforce — enforce 2FA globally or per group
• twofactorauth:state — show 2FA state for a user
• twofactorauth:cleanup — clean up removed provider associations
• tag:files:add/delete/delete-all — assign system tags to files

Writing quality improvements:

• Fix user:profile examples (missing sudo prefix)
• Rewrite user:list and user:info intros
• Fix user:report backtick formatting
• Mark user:add-app-password as deprecated
• Restructure user:disable/enable into a named section; note that sessions are invalidated within 5 minutes, not immediately, with a pointer to user:auth-tokens:delete for immediate invalidation
• Restore accurate newUser.sendEmail default behaviour note
• Update group command listing to include group:info
• Expand 2FA section with full command listing and new commands
• Rewrite System Tags section with concrete examples and real output; add per-command headings; escape tag:* headings to prevent docutils treating 'tag:' as a URI scheme (RFC 4151); note tag:edit --color="" workaround; link access levels to automated_tagging docs; clarify that tag:files:add access identifies the tag and auto-creates it
• Standardize all examples to use layla as the example user
• Use milliways as the example group name

AI-Assisted-By: Claude Sonnet 4.6 noreply@anthropic.com

🖼️ Screenshots