updates

docs/FRONTEND.md

@@ -81,6 +81,9 @@ No router library — a tiny history wrapper (`lib/route.ts`: `navigate()`,
 - `Markdown.tsx` — `react-markdown` + GFM; code blocks get a language label, a
   copy button and dependency-free syntax highlighting (`lib/highlight.tsx` —
   regex tokenizer, no highlight.js, so the Nix offline lockfile is untouched).
+- Assistant bubbles show the producing model (`<model>` chip in the footer,
+  stored per message in `messages.model` — survives model switches; same
+  chip on the streaming bubble and shared pages).
 - Admin Center tabs are deep-linkable (`/admin`, `/admin/models`,
   `/admin/stats`, `/admin/access`, … — `lib/route.ts` `adminTabFromPath`, SPA fallback serves
   them all). Models tab: `OllamaNodes.tsx` (pool with weights, per-node live

docs/OPERATIONS.md

@@ -126,7 +126,10 @@ dedicated per-IP envelope (separate from login brute-force protection):
 every hit counts, successes included (recovery answers are always-ok by
 design, so enumeration is impossible). Over-limit answers 429 with
 `retryAfterSec` + `Retry-After`. The limits are admin-configurable live in
-Admin Center → Mail → Password recovery limits, no restart.
+Admin Center → Mail → Password recovery limits, no restart. Admins can also
+email a one-time reset link to any user with an address from the Accounts
+tab (`POST /api/admin/users/:id/reset-link` — 409 without email, 501
+without SMTP).
 
 ## Model access policy (kill-switch + rate limits)