Replace plaintext password welcome emails with activation links #1718

Goal

Ensure user passwords are never sent by email.

Context

UserRequestHandler currently builds welcome email content containing the generated or supplied password.

Acceptance criteria

• Welcome emails contain a short-lived, single-use account activation link instead of a password.
• The user must set a password through the activation flow.
• Password values do not appear in email payloads, logs, or API responses.
• Tests cover activation expiry, reuse, and invalid tokens.