fix(admin): ship templates in wheel, fix CSP and bootstrap login

tests/test_modules.py

@@ -2,6 +2,14 @@
 
 from __future__ import annotations
 
+import shutil
+import subprocess
+import tomllib
+import zipfile
+from pathlib import Path
+
+import pytest
+
 from volumen.admin_auth_routes import router as auth_router
 from volumen.admin_media_routes import router as media_router
 from volumen.admin_post_routes import router as post_router
@@ -21,3 +29,68 @@ def test_split_modules_import_and_construct_app(config, store) -> None:
 
     assert app.state.config is config
     assert app.state.store is store
+
+
+# ---------------------------------------------------------------------------
+# Distribution wheel — make sure admin assets are packaged.
+# ---------------------------------------------------------------------------
+
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+
+
+def test_pyproject_declares_web_package_data() -> None:
+    """Regression: admin panel returned 500 in production because Jinja
+    templates and SVG icons were not declared as package data and the
+    wheel dropped them. Catch accidental removal in pyproject.toml."""
+    data = tomllib.loads((REPO_ROOT / "pyproject.toml").read_text())
+    package_data = (
+        data.get("tool", {}).get("setuptools", {}).get("package-data", {}).get("volumen", [])
+    )
+    assert any("web/templates" in p and "*.jinja" in p for p in package_data), (
+        f"volumen package-data must include web/templates/*.jinja, got: {package_data}"
+    )
+    assert any("web/static" in p for p in package_data), (
+        f"volumen package-data must include web/static/*.svg, got: {package_data}"
+    )
+
+
+def test_built_wheel_contains_web_templates_and_static(tmp_path: Path) -> None:
+    """Stronger version of the regression: build a wheel with ``uv build``
+    and assert the admin assets are inside the resulting archive. Skipped
+    when ``uv`` is not on PATH (e.g. minimal CI image)."""
+    uv = shutil.which("uv")
+    if uv is None:
+        pytest.skip("uv not on PATH — cannot build the wheel")
+
+    out_dir = tmp_path / "wheels"
+    out_dir.mkdir()
+    result = subprocess.run(
+        [uv, "build", "--wheel", "--out-dir", str(out_dir)],
+        cwd=str(REPO_ROOT),
+        capture_output=True,
+        text=True,
+    )
+    assert result.returncode == 0, (
+        f"uv build failed (exit {result.returncode}):\n"
+        f"stdout:\n{result.stdout}\n"
+        f"stderr:\n{result.stderr}"
+    )
+
+    wheels = sorted(out_dir.glob("*.whl"))
+    assert len(wheels) == 1, f"Expected exactly one wheel, got {wheels}"
+    with zipfile.ZipFile(wheels[0]) as zf:
+        names = zf.namelist()
+
+    templates = [n for n in names if n.startswith("volumen/web/templates/")]
+    statics = [n for n in names if n.startswith("volumen/web/static/")]
+    assert templates, (
+        f"web/templates missing from wheel {wheels[0].name}; "
+        f"admin panel would 500 on first request. Members: {names}"
+    )
+    assert statics, (
+        f"web/static missing from wheel {wheels[0].name}; "
+        f"admin panel icons would 404. Members: {names}"
+    )
+    assert any(n.endswith(".jinja") for n in templates), templates
+    assert any(n.endswith(".svg") for n in statics), statics