3.7 and 2.8 for LubeLogger on 9202, through traefik over https, 2026-10-10
(the first attempt used /Login/SendRegistrationToken, which is the self-service path and is
 correctly disabled; the household's way is the admin's own GenerateNewToken)

household signs in: http=200
--- 3.7 the admin mints a registration token for a family member (autoNotify=false, no mail needed)
POST /Admin/GenerateNewToken -> {"success":true,"message":"Token Generated!"}
the token the admin page shows: <found, not printed>f64f115f
the family member registers with it: {"success":true,"message":"You will be redirected to the login page briefly."}
the family member signs in: http=200 {"success":true,"message":""}
  control, the same member with a wrong password: {"success":false,"message":"Invalid Login Credentials"}
--- 2.8 a file the household uploads opens again through the front door
POST /Files/HandleFileUpload -> "/temp/906cbdd0-878f-4fa4-aa4e-b5792a8afa9b.pdf"
GET it back -> http=200, content matches: 1
the same GET with NO credentials -> http=302 (must not be 200)
