fix(admin): ship templates in wheel, fix CSP and bootstrap login

tests/test_users.py

@@ -23,6 +23,34 @@ class TestBootstrap:
         users = Users(path=users_path)
         assert not users.any
 
+    def test_bootstrap_used_when_users_file_is_empty(
+        self, users_path: str, bootstrap_hash: str
+    ) -> None:
+        # Regression: `volumen init` calls `users_file.touch(exist_ok=True)`
+        # which leaves a zero-byte users.toml. The bootstrap admin must
+        # still be usable so the very first login after `volumen init`
+        # works in production.
+        with open(users_path, "w") as fh:
+            fh.write("")
+        users = Users(path=users_path, bootstrap_hash=bootstrap_hash)
+        assert users.any
+        assert users.authenticate("admin", "volumen-test-password") is not None
+
+    def test_bootstrap_ignored_when_users_present(
+        self, users_path: str, bootstrap_hash: str
+    ) -> None:
+        # Bootstrap must NOT shadow a populated users file — otherwise the
+        # configured `admin` user could log in with the bootstrap password
+        # even after their stored hash was rotated.
+        writer = Users(path=users_path)
+        writer.add("alice", "alice-test-password")
+        writer.add("bob", "bob-test-password")
+
+        reader = Users(path=users_path, bootstrap_hash=bootstrap_hash)
+        usernames = {u.username for u in reader.all}
+        # Only alice + bob from disk; no synthetic admin from bootstrap.
+        assert usernames == {"alice", "bob"}
+
 
 class TestFind:
     def test_find_existing_user(self, users: Users) -> None: