add MFA, user web mail portal

internal/db/admin_models.go

@@ -3,10 +3,17 @@ package db
 import "time"
 
 type AdminUser struct {
-	ID                 int64
-	Username           string
-	PasswordHash       string
+	ID           int64
+	Username     string
+	PasswordHash string
+	// MustChangePassword forces a password change before this admin can use the rest
+	// of the dashboard — true for the seeded default account and every newly-created
+	// admin (delegated or not). MustChangeUsername additionally forces choosing a new
+	// username too — true only for the seeded default account (username "admin"),
+	// never for admins created via the delegation flow, who pick their own username
+	// up front (see addAdmin/CreateScopedAdminUser).
 	MustChangePassword bool
+	MustChangeUsername bool
 	TOTPSecret         string
 	TOTPEnabled        bool
 	IsGlobalAdmin      bool