[markusbrand]

Summary

When an administrator creates a new user via the desktop client (Tauri UI), two interacting defects occurred:

1. ApiClient::create_user in client-tauri/src-tauri/src/api.rs unconditionally included the test header X-E2E-Return-Temp-Password: 1. This forced the backend into skip_email = True, completely bypassing welcome email delivery even when SMTP is configured.
2. In client-tauri/src/Settings.tsx, the UI ignored the response from api_create_user and immediately closed the modal without inspecting temp_password. In environments without SMTP configured (or when credentials must be transferred out-of-band), the returned temporary password was completely lost, rendering newly created accounts permanently inaccessible.

Additionally, resolved a time-dependent test failure in backend/tests/test_telemetry.py where a hardcoded timestamp (2026-09-16) exceeded the 30-day retention threshold, causing prune_telemetry_records to prematurely delete test summaries during ingestion.

Key Changes

• Client API (client-tauri/src-tauri/src/api.rs):
  • Removed X-E2E-Return-Temp-Password: 1 header injection from ApiClient::create_user.
  • Added unit test test_create_user_does_not_send_e2e_password_header verifying production headers via local TCP listener.
• Client UI (client-tauri/src/Settings.tsx):
  • Captured response from api_create_user.
  • Display temporary password modal with copy-to-clipboard button and security notice when temp_password is returned.
  • Show success banner confirming email invitation delivery when temp_password is absent.
  • Added loading indicator and disabled inputs during user creation.
• Backend Test Suite (backend/tests/test_telemetry.py):
  • Replaced hardcoded 2026-09-16 timestamp with dynamic ISO timestamp to prevent false failures from 30-day retention pruning.
• OpenSpec Artifacts:
  • Added change specification in openspec/changes/fix-client-create-user-password-handling/.

Verification

• cargo test in client-tauri/src-tauri: 22 passed, 0 failed, 3 ignored (live cloudflare).
• npm run build in client-tauri: Passed cleanly (tsc && vite build).
• Full QA run (./scripts/run-qa.sh): Passed across client-tauri, web, backend (108 pytest tests), and mkdocs.
• OpenSpec validation (openspec validate --strict fix-client-create-user-password-handling): Valid.