docs: document --dapc seed flag for air-gapped OSS installs

[darcyYe]

Summary

Documents the new db seed --disable-admin-pwned-password-check (alias --dapc) flag added to @logto/cli in logto-io/logto#8859. The flag pre-disables the Have I Been Pwned (HIBP) breach check on the admin tenant, unblocking first-admin sign-up for OSS deployments that cannot reach api.pwnedpasswords.com (air-gapped data centers, strict egress firewalls).

Files updated:

• docs/logto-oss/using-cli/README.mdx — new section "Seed for air-gapped or offline deployments" describing the flag, its scope (admin tenant only), and how to re-enable HIBP later from the Admin Console > Sign-in experience > Password policy.
• docs/logto-oss/deployment-and-configuration.mdx — short admonition under "Database setup" cross-referencing the new CLI section so air-gapped operators see the flag while planning their Postgres setup.

Only English docs are updated. Translated copies under i18n/ are left to the regular translation pipeline.

Testing

Tested locally

Checklist

• .changeset (only when explicitly required)
• unit tests
• integration tests
• necessary TSDoc comments

[Copilot]

Pull request overview

This PR updates Logto OSS documentation to explain the new db seed --dapc / --disable-admin-pwned-password-check flag in @logto/cli, aimed at unblocking first-admin sign-up in air-gapped/offline environments where api.pwnedpasswords.com is unreachable.

Changes:

• Adds a new “Seed for air-gapped or offline deployments” section to the Logto CLI docs, including usage examples and scope notes (admin tenant only).
• Adds a cross-referenced tip under “Database setup” in deployment docs to help operators discover the flag during installation planning.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
docs/logto-oss/using-cli/README.mdx	Documents --dapc behavior, scope, and provides CLI/npm/npx examples with a stable anchor for cross-linking.
docs/logto-oss/deployment-and-configuration.mdx	Adds an “Air-gapped or offline installs” tip that points readers to the detailed CLI documentation section.

Comments suppressed due to low confidence (1)

docs/logto-oss/using-cli/README.mdx:91

• The service name is typically written as “Have I Been Pwned” (HIBP). Consider updating the link text to match the official name for clarity and consistency.

When set, the seeded `sign_in_experiences.password_policy` row for the **admin tenant** is `{"rejects": {"pwned": false}}` instead of the default `{}`. This skips the [HaveIBeenPwned (HIBP)](https://haveibeenpwned.com/) password breach check during the first admin sign-up, so creating the initial admin from the Welcome page no longer hangs when `api.pwnedpasswords.com` is unreachable (for example in air-gapped data centers or behind strict egress firewalls).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[xiaoyijun]

Pushed a few follow-up commits to this branch (via maintainerCanModify). Summary of what changed and why:

Correctness

• Removed the "re-enable from the Admin Console" claim. The flag only seeds the admin tenant's sign-in experience, which is not exposed in the Admin Console (the Console manages the default/other tenants). There is currently no Console path to toggle the HIBP check on the admin tenant, so the old sentence was misleading. We also don't document raw SQL for this, so I just dropped the sentence. (48b0ae362)
• Dropped the --oc row from the install options table. logto init has no --oc option; official connectors are added separately via logto connector add --official. (48b0ae362)
• Reworded the alias note. In the current CLI, --dapc is the canonical option key and --disable-admin-pwned-password-check is its alias (these were swapped after this PR was first drafted). Both work as input, so the wording is now neutral ("…are aliases; either one works") instead of calling --dapc the "short alias". (48b0ae362)

Polish

• Install options → Markdown table. Replaced the hand-aligned bash block with a table; the cross-reference link now lives in the --dapc description cell and renders as a real link (it can't inside a code fence). (fab9c8e18, supersedes 266883778)
• Removed em-dashes from the new air-gapped section. (b8d483b19)
• Added an npx tab to "One-step install" so it matches the seed group (CLI/npm/npx). The two npm tabs intentionally differ — npm init @logto@latest for a fresh install vs. npm run cli inside an existing instance. (2ac967557)

Verified locally with docusaurus start: both pages compile and render.