feat(admin): Anmeldehinweise der Willkommensmail in der Vorlage bearbeitbar

Neue Felder loginHintDirectory/loginHintLocal (Platzhalter, Pflicht, max. 1000),
Migration 20260930170000 (nullable, leer = Standard aus @tessera/shared).
Knopf Passwort festlegen und Gueltigkeitshinweis bleiben fest; local-no-link
wird nie erzeugt und bleibt fest. Vorschau springt beim Bearbeiten auf die
passende Kontoart. Lokal im Browser nachgewiesen.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/web/src/messages/en.json

@@ -746,7 +746,7 @@
       "loading": "Loading template …",
       "fixed": {
         "title": "What you can change – and what always stays",
-        "body": "You decide the subject, heading, introduction and closing text. Everything needed to sign in is always added automatically and cannot be changed: the header with logo, the box with address and username, the sign-in hint including the “Set password” button for local accounts, the “Go to Tessera” button and the footer. This way a custom template cannot break sign-in."
+        "body": "You decide the subject, heading, introduction, closing text and the sign-in hint – separately for directory accounts and for local accounts. Everything technically needed to sign in is always added automatically and cannot be changed: the header with logo, the box with address and username, the “Set password” button with its link and validity note for local accounts, the “Go to Tessera” button and the footer. This way a custom template cannot break sign-in."
       },
       "statusDefault": "The default texts are currently in use.",
       "statusCustom": "Custom template active – last changed on {date}.",
@@ -759,6 +759,10 @@
         "headingHelp": "Large line at the top of the email, required.",
         "intro": "Introduction",
         "introHelp": "Shown below the heading. An empty line starts a new paragraph.",
+        "loginHintDirectory": "Sign-in hint for directory accounts",
+        "loginHintDirectoryHelp": "Shown below the box with the sign-in details when the user comes from the directory (Active Directory/LDAP) and signs in with their usual Windows password. Required.",
+        "loginHintLocal": "Sign-in hint for local accounts",
+        "loginHintLocalHelp": "Shown for local accounts right before the “Set password” button. Tessera always adds the button and the validity note below it. Required.",
         "closing": "Closing text",
         "closingHelp": "Shown at the end of the email, e.g. a tip and a sign-off. May be left empty."
       },