feat(enterprise): add first-login rotation and receipt bridge

deployment/enterprise-domain-bootstrap/enterprise-lighthouse/enterprise_identity_service.test.py

@@ -49,10 +49,17 @@ class EnterpriseIdentityTests(unittest.TestCase):
                 tables = {row[0] for row in db.execute("select name from sqlite_master where type='table'")}
                 self.assertIn("relationship_receipts", tables)
                 self.assertIn("responsibility_receipts", tables)
+                self.assertIn("credential_rotation_receipts", tables)
                 db.close()
             finally:
                 service.DB_PATH = old
 
+    def test_password_rotation_source_uses_user_session_and_never_admin_token(self):
+        source = (ROOT / "enterprise_identity_service.py").read_text()
+        self.assertIn("rotate_forgejo_password", source)
+        self.assertIn("/user/settings/change_password", source)
+        self.assertNotIn("FORGEJO_ADMIN_TOKEN", source)
+
 
 if __name__ == "__main__":
     unittest.main()