bank: auto usernames goa-account-<random> shown to user

API and docs describe the visible auto username shape.

configs/bank-landing/README.md

@@ -49,7 +49,8 @@ In the optional fold:
 3. Server registers a new libeufin user via public `POST /accounts`.  
 4. UI shows **username / password / balance GOA:0** once (“created for you”;  
    not stored for recovery).  
-5. Username shape: **`goa-bank-acc-<16-hex>`**.  
+5. Username shape: **`goa-account-<random>`** (shown to the user).  
+   Password embeds **`pleasechangeme`** with random chars around it.
 6. QR_Taler + link open `/webui/` so the user can log in with those credentials.
 
 Balance **starts at zero** — not the shared `explorer` pool.

scripts/taler-bank/README.md

@@ -42,7 +42,7 @@ Details + JSON schema: `configs/bank-landing/README.md`.
 | Path | Behaviour |
 |------|-----------|
 | `GET /demo-withdraw.json` | Mint one-shot withdraw from shared **`explorer`** pool; write `withdraw.uri` + watch ids |
-| `GET /auto-account.json` | Public `POST /accounts` with generated **`goa-bank-acc-<hex>`** user + password; **balance GOA:0**; return credentials once |
+| `GET /auto-account.json` | Public `POST /accounts` with generated **`goa-account-<random>`** user + password containing **pleasechangeme**; **balance GOA:0**; return credentials once |
 
 Install / restart:
 

scripts/taler-bank/demo-withdraw-api.py

@@ -124,8 +124,10 @@ def mint_withdraw() -> dict:
 
 
 def _rand_username() -> str:
-    # goa-bank-acc-<uuid> — unique guest id, bank-safe [a-z0-9-]
-    return "goa-bank-acc-" + secrets.token_hex(8)
+    # Shown to the user: goa-account-<random> (bank-safe [a-z0-9-])
+    alphabet = string.ascii_lowercase + string.digits
+    rnd = "".join(secrets.choice(alphabet) for _ in range(12))
+    return "goa-account-" + rnd
 
 
 def _rand_password() -> str:
@@ -140,9 +142,8 @@ def create_personal_account() -> dict:
     """Public registration: auto username/password, balance starts at 0."""
     username = _rand_username()
     password = _rand_password()
-    # short label from id suffix
-    suffix = username.rsplit("-", 1)[-1][:8]
-    name = "GOA bank acc " + suffix
+    # Display name mirrors username for webui clarity
+    name = username
     code, body = http_json(
         "POST",
         f"{BANK}/accounts",
@@ -156,8 +157,7 @@ def create_personal_account() -> dict:
         # retry once on conflict
         if code in (409, 400):
             username = _rand_username()
-            suffix = username.rsplit("-", 1)[-1][:8]
-            name = "GOA bank acc " + suffix
+            name = username
             code, body = http_json(
                 "POST",
                 f"{BANK}/accounts",