vaultwarden: compose header matches invite-first; live proof lines (R-512/R-514)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/vaultwarden/docker-compose.yml

@@ -6,12 +6,12 @@
 # Environment variables:
 #   DOMAIN            - Your domain (e.g., demo-felhom.eu)
 #   ADMIN_TOKEN       - Admin panel token (auto-generated)
-#   SIGNUPS_ALLOWED   - Set to "false" after creating your account(s)
+#   SIGNUPS_ALLOWED   - "false" by default (R-512): only invited addresses can register
 #
-# First-time setup:
-#   1. Visit https://${SUBDOMAIN}.${DOMAIN} and create an account
-#   2. Set SIGNUPS_ALLOWED=false via the controller
-#   3. Admin panel at https://${SUBDOMAIN}.${DOMAIN}/admin (if ADMIN_TOKEN set)
+# First-time setup (invite-first; settings are read-only after install):
+#   1. Open https://${SUBDOMAIN}.${DOMAIN}/admin with the generated ADMIN_TOKEN
+#   2. Invite the household's addresses (Users → Invite User; works without mail)
+#   3. Visit https://${SUBDOMAIN}.${DOMAIN} and create the account with an invited address
 #
 # Clients:
 #   Use any Bitwarden client (desktop, mobile, browser extension)