fix(admin): ship templates in wheel, fix CSP and bootstrap login

tests/test_admin.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import os
 import re
 from pathlib import Path
 
@@ -27,6 +28,29 @@ class TestAdminLogin:
         assert response.status_code == 200
         assert "Sign in" in response.text
 
+    def test_login_page_omits_warning_when_users_exist(self, admin_client: TestClient) -> None:
+        # Regression: `users_exist` was missing from the admin template
+        # context, so the "No users configured" warning was shown on every
+        # login page render regardless of whether authentication worked.
+        response = admin_client.get("/admin/login")
+        assert response.status_code == 200
+        assert "No users configured" not in response.text
+
+    def test_login_page_shows_warning_when_no_users(self, config, store) -> None:
+        # No bootstrap_hash, no users.toml → `users_exist` must be False
+        # so the warning block is rendered.
+        from volumen.app import create_app
+
+        users_path = config.users_file
+        # Make sure no stale users file exists.
+        if os.path.exists(users_path):
+            os.remove(users_path)
+        app = create_app(config, store)
+        client = TestClient(app)
+        response = client.get("/admin/login")
+        assert response.status_code == 200
+        assert "No users configured" in response.text
+
     def test_login_with_valid_credentials(self, admin_client: TestClient) -> None:
         resp = admin_client.get("/admin/login")
         token = _csrf_from_body(resp.text)
@@ -424,13 +448,31 @@ class TestOrphanedSession:
     def test_orphaned_session_is_rejected(
         self, admin_client: TestClient, admin_config_dir: Path
     ) -> None:
+        import tomli_w
+
+        from volumen.password import hash_password as hash_pw
+
         _login(admin_client)
         resp = admin_client.get("/admin/")
         assert resp.status_code == 200
 
-        # Clear users file to simulate deleted user
+        # Replace users file with a different admin so the logged-in
+        # 'admin' is truly orphaned. An empty file would resurrect the
+        # bootstrap admin via the password_hash fallback, so we must
+        # write a real users list that does not include 'admin'.
         users_path = admin_config_dir / "users.toml"
-        users_path.write_text("")
+        payload = tomli_w.dumps(
+            {
+                "users": [
+                    {
+                        "username": "other",
+                        "password_hash": hash_pw("other-password"),
+                        "role": "admin",
+                    }
+                ]
+            }
+        ).encode("utf-8")
+        users_path.write_bytes(payload)
 
         resp = admin_client.get("/admin/", follow_redirects=False)
         assert resp.status_code in (302, 307, 303)