feat(PROJ-28): Self-Service Onboarding — Signup, Verify, Password Reset, Invites

- internal/mailer: SMTP-Out via net/smtp (TLS + STARTTLS), HTML+Text-Templates
- internal/tokenstore: auth_tokens Tabelle, SHA-256-Hash, TTL, einmalig verwendbar
- userstore: CreateInactive(), Activate(), GetByEmail(), SetPassword()
- API: POST /signup, GET /verify, POST /forgot-password, POST /reset-password
- API: POST /admin/invite (domain_admin+), GET /auth/invite?token (check)
- Login-Seite: Links zu "Passwort vergessen" und "Registrieren"
- Frontend: /signup, /verify, /forgot-password, /reset-password Seiten
- server.fqdn nicht konfiguriert → Startup-Warnung, Self-Service deaktiviert
- LDAP-Nutzer: Passwort-Reset abgewiesen

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/archivmail/main.go

@@ -18,6 +18,8 @@ import (
 
 	"golang.org/x/crypto/hkdf"
 
+	"github.com/jackc/pgx/v5/pgxpool"
+
 	"github.com/archivmail/config"
 	"github.com/archivmail/internal/api"
 	"github.com/archivmail/internal/audit"
@@ -27,10 +29,12 @@ import (
 	"github.com/archivmail/internal/index"
 	"github.com/archivmail/internal/labelstore"
 	ldapcfg "github.com/archivmail/internal/ldapconfig"
+	"github.com/archivmail/internal/mailer"
 	pop3store "github.com/archivmail/internal/pop3"
 	"github.com/archivmail/internal/smtpd"
 	"github.com/archivmail/internal/storage"
 	tenantstore "github.com/archivmail/internal/tenantstore"
+	"github.com/archivmail/internal/tokenstore"
 	"github.com/archivmail/internal/userstore"
 	"github.com/archivmail/pkg/mailparser"
 )
@@ -179,6 +183,26 @@ func main() {
 	srv.SetVersion(AppVersion, Modules)
 	srv.SetGlobalRetentionDays(cfg.Storage.RetentionDays)
 
+	// PROJ-28: Self-Service Onboarding — mailer + token store + FQDN
+	mlr := mailer.New(cfg.SMTPOut)
+	srv.SetMailer(mlr)
+	srv.SetFQDN(cfg.Server.FQDN)
+	if cfg.Server.FQDN == "" {
+		logger.Warn("server.fqdn not set — signup/reset links will not work (PROJ-28)")
+	}
+	tokenPool, err := pgxpool.New(context.Background(), cfg.Database.DSN())
+	if err != nil {
+		logger.Error("token store pool failed", "err", err)
+		os.Exit(1)
+	}
+	defer tokenPool.Close()
+	tokenSt, err := tokenstore.New(tokenPool)
+	if err != nil {
+		logger.Error("token store init failed", "err", err)
+		os.Exit(1)
+	}
+	srv.SetTokenStore(tokenSt)
+
 	bind := cfg.API.Bind
 	if bind == "" {
 		bind = fmt.Sprintf(":%d", cfg.Server.APIPort)