Set Password — Staff Activation

• Screen: SCR-IDP.14 — Set Password — Staff Activation
• Use case: UC-IDP.03 — Activate Staff Account (main flow step 4–5, after Email + Password is selected on SCR-IDP.12)

Password-setting screen for staff/instructor account activation — shown after the invitee successfully verifies identity via the Email + Password path in UC-IDP.03. Shows the invitee's full name from the UserInvitation record to confirm context before the user sets a password. The system validates complexity per SS-IDP.19 (minimum 8 characters, at least one uppercase letter, one lowercase letter, and one digit) and checks that both entries match. Separated from SCR-IDP.11 (learner registration) to allow dedicated back-office branding and copy.

• invited_fullname "Welcome" — text · session.invited_fullname (UserInvitation.firstname + " " + lastname, set at link validation) · always · read-only · client must not fetch UserInvitation directly
• new_password "New Password" — password · required · validation: min_length:8, has_uppercase, has_lowercase, has_digit [SS-IDP.19]
• confirm_password "Confirm New Password" — password · required · validation: must_match:new_password

• submit "Set Password & Activate" — enabled when required_fields_valid · triggers UC-IDP.03-M-5

1. Show real-time password checklist as user types in new_password — each criterion changes from pending to success icon when met: min 8 chars, ≥1 uppercase, ≥1 lowercase, ≥1 digit. [refs: SS-IDP.19]
2. invited_fullname sourced from session.invited_fullname (server-composed from UserInvitation, set at link validation). Client must not fetch UserInvitation directly.
3. Error "Passwords do not match" must appear inline below confirm_password on blur or submit — not as a toast or alert.
4. There is no Back or Cancel button on this screen — once the invitee reaches this screen, they must complete the password before leaving the flow. The browser Back button must not return the user to the Activation Landing screen (SCR-IDP.12), because the activation token session is invalidated after successful identity verification.