Document two-factor authentication and the password gates Add two-factor authentication (authenticator apps with recovery codes): OCMS_MFA_KEY and OCMS_REQUIRE_MFA, the two-step sign-in, the account security page, administrator and command-line resets, recovery after the key changes, and demo mode leaving it off. Document the acting administrator's password for account-handing user changes and second-factor resets, the password needed to activate DB Manager, import overwrites never changing the admin role, the new event log entries, and Go 1.27.3 as the minimum version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Correct wiki pages against the code Fix statements the code contradicts across the module, security, configuration, deployment and reference pages, and document OCMS_ENV_FILE and the site.mk env guard.
Describe IPv6 lockout scoping and DB Manager history truncation Note that IPv6 clients are keyed on their /64 with the distributed attacker budget, and that the DB Manager history records truncated results and names the statement timeout.
Document admin-only module routes and hardened defaults Describe the registry's admin-only gate with the editor opt-in, the DB Manager's inactive default and query limits, placeholder secret rejection, the seed guard for the default admin, and the theme import password confirmation.
Add comprehensive wiki documentation