docs(3201): setup guide — the group flag is not one-shot any more

The step-3 warning said to keep `--group admins` and left the impression
that a later re-run would fix a missing one. It would not: `user add`
refuses on an existing name, so until `user update` existed the only
repair was hand-editing two files as root. mara asked the question the
warning should have answered — "will the cmd just add the group or do i
get a whole new user?".

Deliberately in this PR rather than #3199's: the sentence only becomes
true once the verb it names exists.
This commit is contained in:
atlas 2026-08-12 18:33:53 +02:00 committed by mara
commit ae05289e8b

View file

@ -54,6 +54,10 @@ surfaces (the swarm UI below) are gated on that group, and an account
without it authenticates successfully and is then refused — which reads
like a broken login rather than a missing group.
If an account already exists without it, `user add` will refuse rather
than amend — adding the group afterwards is `swarmctl user update mara
--add-group admins`.
Detail, including what the password is and why this stays manual:
[`swarm/sso.md`](swarm/sso.md).