document secure administrative user management engineering request

[unattributed]

Summary

Adds a bounded engineering request for a future OSMAP administrative control plane covering domains, mailboxes, aliases, credentials, account state, and TOTP lifecycle.

Rationale

User administration currently depends on PostfixAdmin, while OSMAP TOTP enrollment remains an operator-managed filesystem procedure. This proposal records a secure path toward supported administration without expanding the browser-facing OSMAP process into a general privileged control plane.

Proposed direction

• begin with a reviewed operator CLI for identity inspection and TOTP enrollment, verification, rotation, revocation, and recovery
• introduce a dedicated least-privilege administrative service boundary
• add a separately authorized OSMAP administrative page only after the lower-level boundary is proven
• retain PostfixAdmin until workflow parity, migration, coexistence, rollback, production validation, and a separate retirement decision are complete

Security and governance

The request requires deny-by-default authorization, administrator MFA and reauthentication, canonical identity handling, secret-safe audit records, transactional or bounded mutations, negative-path and concurrency testing, OpenBSD validation, reversible deployment, and sanitized evidence.

This PR is documentation-only. It does not add administrative functionality, alter production behavior, or claim that PostfixAdmin can currently be retired.

Validation

• documentation-only diff reviewed against current project charter, identity model, and TOTP secret-management boundary
• branch is one commit ahead of main with no unrelated changes