feat: ( iam ) add forgot and change password to passenger backoffice

apps/edr-passenger-api/.env.example

@@ -43,6 +43,13 @@ JWT_ACCESS_TOKEN_EXPIRES=1h
 JWT_REFRESH_TOKEN_SECRET=<change-me-min-32-chars>
 JWT_REFRESH_TOKEN_EXPIRES=7d
 
+# @tria-plc IAM forgot-password flow — the reset link sent via SMS is
+# ${FE_BASE_URL}/reset-password?email=..&userId=..&verificationCode=..
+# Point at the backoffice web app. Without it the link starts with "undefined/".
+FE_BASE_URL=http://localhost:5184
+# OTP/reset-link TTL in minutes (IAM default: 30)
+INVITATION_EXPIRY_DATE=30
+
 # SendGrid
 SENDGRID_API_KEY=
 SENDGRID_FROM_EMAIL=noreply@edr-platform.com
@@ -151,7 +158,10 @@ FAYDA_TOKEN_ENDPOINT=
 FAYDA_USERINFO_ENDPOINT=
 # Base64 of the RSA private JWK (JSON). Secret — never commit a real value.
 FAYDA_PRIVATE_KEY_BASE64=
+# OAuth redirect_uri passed to eSignet for MOBILE clients (the app calls /complete directly).
 FAYDA_REDIRECT_URI=
+# OAuth redirect_uri passed to eSignet for WEB clients. Defaults to FAYDA_REDIRECT_URI when unset.
+FAYDA_WEB_REDIRECT_URI=
 # Optional (defaults shown)
 FAYDA_SCOPE=openid profile email
 FAYDA_ACR_VALUES=mosip:idp:acr:generated-code
@@ -160,6 +170,15 @@ FAYDA_SESSION_TTL_MINUTES=10
 
 GITHUB_PACKAGE_TOKEN=<your-github-packages-token>
 
+# --- Seeding -----------------------------------------------------------------
+# Set both to true on first run (or when resetting) to seed org, roles, and
+# default backoffice staff users. Safe to leave true — all operations are idempotent.
+# Login endpoint for backoffice users: POST /v1/auth/login
+SEED_EDR_PASSENGER_ORG=false
+SEED_PASSENGER_STAFF=false
+# Plain-text password set on seeded staff accounts. Defaults to '12345678' if unset.
+DEFAULT_PASSWORD=Admin@1234
+
 # --- Notification broker (RabbitMQ) -----------------------------------------------------------------
 # Set RABBITMQ_ENABLED=false to skip connection entirely (dev without a local broker).
 RABBITMQ_ENABLED=false