SMTP mail support and admin pwd change working updated TODO.md

README.md

@@ -68,6 +68,8 @@ python ./scripts/send-test-email.py --to you@example.com
 
 The command works on Windows, Linux, and macOS. It prints `SMTP_TEST_SENT_TO=<address>` only after the SMTP server accepts the message. Confirm the message arrives, then use **Forgot your password?** in the application to verify a real reset email and link. The existing PowerShell alternative remains available as `./scripts/test-smtp.ps1 -To you@example.com`.
 
+SMTP connection and delivery have been verified for the current deployment environment.
+
 ## Production notes
 
 Put this service behind a TLS reverse proxy for `eternityproject.fi` (for example Caddy or Nginx). Set a strong unique `SECRET_KEY`; the Compose file intentionally refuses to start without it. Back up the `eternity_data` Docker volume, which contains accounts and posts.

TODO.md

@@ -4,8 +4,8 @@
 - [x] Local accounts, administrator approval, and TOTP MFA.
 - [x] QR-based MFA enrollment for iPhone and Android authenticators.
 - [x] Email addresses, member password changes, and expiring password-reset links.
-- [ ] Configure production SMTP credentials and verify outgoing email delivery. Run `python ./scripts/check-smtp.py`, then `python ./scripts/send-test-email.py --to you@example.com`; complete after the delivery test in [README.md](README.md) is received.
-- [ ] Run `./scripts/rotate-admin.ps1` on Windows or `sh ./scripts/rotate-admin.sh` on Linux/macOS, then sign in as `admin` and scan the new MFA QR code to complete authenticator enrollment.
+- [x] Configure production SMTP credentials and verify outgoing email delivery.
+- [x] Rotate the initial `admin` password and enroll its authenticator.
 - [x] Add CSRF protection to all state-changing forms.
 - [ ] Add automated database backups and test restoration.
 - [ ] Configure TLS reverse proxy and production domain for `eternityproject.fi`.