docs: update project docs, NC Talk guide, Tina persona, and gitignore

- CLAUDE.md: add new auth/onboarding files to directory map, update
  security section (JWT/bcrypt/invite details), expand recently completed
- README.md: fix Web UI auth description, add User Management section
- TODO__Agents.md: mark NC Talk docs and auth/onboarding complete,
  update Holly onboarding plan to reflect single-instance multi-user approach
- docs/NEXTCLOUD_TALK_BOT.md: complete guide — occ commands, nginx config,
  clarify incoming vs outgoing HMAC difference, multi-user note, full
  troubleshooting table
- home/holly/persona/tina/: flesh out all four persona files with real
  content (DCC name origin, metal music, reading, foster cats, Holly's profile)
- .gitignore: exclude home/**/auth.json, invite.json, profile.json

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -128,12 +128,32 @@ Context is loaded at request time from `home/{user}/persona/{name}/` via `cortex
 
 | Channel | Status | Notes |
 |---|---|---|
-| Web UI | Live | `https://cortex.dgrzone.com` (basic auth) |
+| Web UI | Live | `https://cortex.dgrzone.com` — session auth (login form + JWT cookie) |
 | Nextcloud Talk | Live | HMAC-signed webhook, async reply |
 | Google Chat | Live | Workspace Add-on, JWT auth |
 
 ---
 
+## User Management
+
+```bash
+cd cortex
+
+# Create a user directory and send an invite email
+.venv/bin/python manage_passwords.py invite <username> <email>
+
+# List users with password and email status
+.venv/bin/python manage_passwords.py list
+
+# Set/check a password directly
+.venv/bin/python manage_passwords.py set <username>
+.venv/bin/python manage_passwords.py check <username>
+```
+
+New users receive a link to `/setup/{token}` where they set their own password and create their first persona. Invite tokens expire in 72 hours and are one-time-use.
+
+---
+
 ## Testing
 
 ```bash