docs: document --dapc seed flag for air-gapped OSS installs

[darcyYe]

Summary

Documents the new db seed --disable-admin-pwned-password-check (alias --dapc) flag added to @logto/cli in logto-io/logto#8859. The flag pre-disables the Have I Been Pwned (HIBP) breach check on the admin tenant, unblocking first-admin sign-up for OSS deployments that cannot reach api.pwnedpasswords.com (air-gapped data centers, strict egress firewalls).

Files updated:

• docs/logto-oss/using-cli/README.mdx — new section "Seed for air-gapped or offline deployments" describing the flag, its scope (admin tenant only), and how to re-enable HIBP later from the Admin Console > Sign-in experience > Password policy.
• docs/logto-oss/deployment-and-configuration.mdx — short admonition under "Database setup" cross-referencing the new CLI section so air-gapped operators see the flag while planning their Postgres setup.

Only English docs are updated. Translated copies under i18n/ are left to the regular translation pipeline.

Testing

Tested locally

Checklist

• .changeset (only when explicitly required)
• unit tests
• integration tests
• necessary TSDoc comments

[Copilot]

Pull request overview

This PR updates Logto OSS documentation to explain the new db seed --dapc / --disable-admin-pwned-password-check flag in @logto/cli, aimed at unblocking first-admin sign-up in air-gapped/offline environments where api.pwnedpasswords.com is unreachable.

Changes:

• Adds a new “Seed for air-gapped or offline deployments” section to the Logto CLI docs, including usage examples and scope notes (admin tenant only).
• Adds a cross-referenced tip under “Database setup” in deployment docs to help operators discover the flag during installation planning.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
docs/logto-oss/using-cli/README.mdx	Documents --dapc behavior, scope, and provides CLI/npm/npx examples with a stable anchor for cross-linking.
docs/logto-oss/deployment-and-configuration.mdx	Adds an “Air-gapped or offline installs” tip that points readers to the detailed CLI documentation section.

Comments suppressed due to low confidence (1)

docs/logto-oss/using-cli/README.mdx:91

• The service name is typically written as “Have I Been Pwned” (HIBP). Consider updating the link text to match the official name for clarity and consistency.

When set, the seeded `sign_in_experiences.password_policy` row for the **admin tenant** is `{"rejects": {"pwned": false}}` instead of the default `{}`. This skips the [HaveIBeenPwned (HIBP)](https://haveibeenpwned.com/) password breach check during the first admin sign-up, so creating the initial admin from the Welcome page no longer hangs when `api.pwnedpasswords.com` is unreachable (for example in air-gapped data centers or behind strict egress firewalls).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.