Add sfsr protection and admin pwd change script for powershell

README.md

@@ -17,12 +17,43 @@ Open `http://localhost:8000`, create the first account, and publish a field note
 
 The initial administrator account is `admin` with password `admin`, as requested for first-run access. Sign in, scan the displayed QR code with any iPhone or Android TOTP authenticator, and change this password before exposing the service to the internet. New registrations are held for approval in **Accounts**; accepted users must enroll a TOTP authenticator before they can publish.
 
+### Secure the initial administrator
+
+With the Docker service running, rotate the initial password locally. The command prompts for a new password without writing it to a file or command history. It also clears the old MFA binding so that the next administrator sign-in requires a new QR-based authenticator enrollment.
+
+```powershell
+.\scripts\rotate-admin.ps1
+```
+
+After it prints `ADMIN_PASSWORD_ROTATED_MFA_RESET`, sign in as `admin` with the new password, scan the fresh QR code with an authenticator application, and enter its six-digit code to complete enrollment. Store the new password in a password manager.
+
 ## Email and password recovery
 
 Registration now requires an email address. Members can change their password from the navigation. The sign-in page provides an email-based recovery link; it expires after one hour and can only be used once. Administrators can send the same recovery email to any approved member from **Accounts**.
 
+All browser POST forms are protected by server-validated CSRF tokens.
+
 Set `PUBLIC_URL` and the `MAIL_*` values in `.env` to send recovery emails. The SMTP account must support STARTTLS on the configured port. Review [TODO.md](TODO.md) before production deployment.
 
+### Configure SMTP delivery
+
+1. Copy `.env.example` to `.env` if it does not exist.
+2. Set `PUBLIC_URL=https://eternityproject.fi`.
+3. Enter the SMTP host, port, username, password or provider app password, and verified sender address. Use port `587` for STARTTLS.
+4. Rebuild the service so Compose applies the values:
+
+```sh
+docker compose up --build -d
+```
+
+5. Send a delivery test to an inbox you control:
+
+```powershell
+.\scripts\test-smtp.ps1 -To you@example.com
+```
+
+The command prints `SMTP_TEST_SENT_TO=<address>` only after the SMTP server accepts the message. Confirm the message arrives, then use **Forgot your password?** in the application to verify a real reset email and link.
+
 ## Production notes
 
 Put this service behind a TLS reverse proxy for `eternityproject.fi` (for example Caddy or Nginx). Set a strong unique `SECRET_KEY`; the Compose file intentionally refuses to start without it. Back up the `eternity_data` Docker volume, which contains accounts and posts.