Zitadel asks every user with an unverified address (registration, all
byoidc logins) for a code before the login finishes. Without an SMTP
provider the code was never sent (Errors.SMTPConfig.NotFound) and these
users were stuck. They now come from the send-only account id@lassul.us
on the mailserver, over TLS on mail.lassul.us:465.

lass.zitadel.smtp creates, updates and activates the instance's SMTP
provider. Zitadel 2.71 skips providers without a password, so the
password comes from passwordFile; a hash of the one Zitadel has is kept
in the state directory to update it when the file changes.

find_user tried the configured name as login name first. With
UserLoginMustBeDomain off (Zitadel's default and ours), anyone who
registers picks any free username, including lass@lassul.us or the
address of someone who has not registered yet, and got the grant meant
for that address. Only a verified address cannot be claimed this way.

HedgeDoc looks up users only by profileid, in one table with the GitHub
logins, whose profileid is the numeric GitHub user id. Without
userProfileIdAttr it is the username, which anyone chooses when
registering at id.lassul.us: a Zitadel user named after someone's GitHub
id logged in as that GitHub user, and a renamed or deleted username
handed its pad account to the next user taking the name. sub is the
Zitadel user id, which Zitadel generates and never reuses.

Existing Zitadel accounts in HedgeDoc are keyed by their login name and
need their profileid changed to the Zitadel user id.