# Staff registration and password-reset module

Public routes:

- `/register` submits an inactive, roleless account for review.
- `/forgot-password` sends a reset link only for active, approved accounts.

Administrator review is available in **Administration → Users**. Only a user with the
actual `Admin` role can approve or reject a request. Approval assigns one non-administrator
primary role and activates the account. Rejections require a recorded reason.

After deploying this update, run:

```bash
php artisan migrate --force
php artisan optimize:clear
```

Password-reset email requires SMTP configuration:

```env
MAIL_MAILER=smtp
MAIL_HOST=mail.example.com
MAIL_PORT=587
MAIL_USERNAME=ris@example.com
MAIL_PASSWORD="your-smtp-password"
MAIL_FROM_ADDRESS=ris@example.com
MAIL_FROM_NAME="Oziris RIS"
```

Use `MAIL_SCHEME=smtps` for implicit TLS on port 465. Ensure `APP_URL` contains the correct
HTTPS production URL so reset links point to the correct domain.
