Document two-factor authentication and the password gates Add two-factor authentication (authenticator apps with recovery codes): OCMS_MFA_KEY and OCMS_REQUIRE_MFA, the two-step sign-in, the account security page, administrator and command-line resets, recovery after the key changes, and demo mode leaving it off. Document the acting administrator's password for account-handing user changes and second-factor resets, the password needed to activate DB Manager, import overwrites never changing the admin role, the new event log entries, and Go 1.27.3 as the minimum version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Correct wiki pages against the code Fix statements the code contradicts across the module, security, configuration, deployment and reference pages, and document OCMS_ENV_FILE and the site.mk env guard.
Document the account dashboard and audit fixes Add the Account Dashboard page and role-based login destinations (#188). Document reserved route names for slugs, the module-aware CSP with COOP/CORP headers, CSPSourcer for custom modules, and the loopback-only Docker publish address.
Describe IPv6 lockout scoping and DB Manager history truncation Note that IPv6 clients are keyed on their /64 with the distributed attacker budget, and that the DB Manager history records truncated results and names the statement timeout.
Clarify session scope and the module admin-route drift test Say that the idle timeout applies to every session and that the editor opt-in list is kept by a drift test, not a startup check.
Document scoped login lockout, session idle timeout and secret role Describe the email-plus-address lockout with its account-wide ceiling, the two-hour idle session timeout, and the session secret's role as the CSRF key with server-side sessions.
Document admin-only module routes and hardened defaults Describe the registry's admin-only gate with the editor opt-in, the DB Manager's inactive default and query limits, placeholder secret rejection, the seed guard for the default admin, and the theme import password confirmation.
Document HSTS preload and deployment hardening Mirror docs/reverse-proxy.md and docs/login-security.md from the main repo. Reverse-Proxy gains an HSTS Preload section covering the OCMS_HSTS_PRELOAD env var and the hstspreload.org submission process, including the effectively-permanent nature of preload entries. Login-Security gains a Production Deployment Checklist whose first item is rotating the seeded admin credentials, since OCMS_DO_SEED=true provisions the well-known admin@example.com / changeme1234.
Add comprehensive wiki documentation