feat: add system settings page for admin username and password

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_auth.py

@@ -24,12 +24,17 @@ def _restore(old: dict):
 def test_issue_token_ok():
     from apps.api.auth import expected_token, issue_token
 
-    old = _with_env(AUTH_SECRET="unit-secret", ADMIN_PASSWORD="pass123")
+    old = _with_env(
+        AUTH_SECRET="unit-secret",
+        ADMIN_USERNAME="admin",
+        ADMIN_PASSWORD="pass123",
+    )
     try:
-        tok = issue_token("pass123")
+        tok = issue_token("admin", "pass123")
         assert tok is not None
         assert tok == expected_token()
-        assert issue_token("wrong") is None
+        assert issue_token("admin", "wrong") is None
+        assert issue_token("wrong", "pass123") is None
     finally:
         _restore(old)
 

tests/test_env_file.py

@@ -0,0 +1,15 @@
+from pathlib import Path
+
+from packages.config.env_file import read_env_value, update_env_file
+
+
+def test_update_env_file(tmp_path: Path):
+    envf = tmp_path / ".env"
+    envf.write_text("FOO=bar\n# comment\nBAZ=old\n", encoding="utf-8")
+    update_env_file(envf, {"BAZ": "new", "ADMIN_USERNAME": "alice"})
+    text = envf.read_text(encoding="utf-8")
+    assert "FOO=bar" in text
+    assert "BAZ=new" in text
+    assert "ADMIN_USERNAME=alice" in text
+    assert read_env_value(envf, "BAZ") == "new"
+    assert read_env_value(envf, "ADMIN_USERNAME") == "alice"