feat: add local admin authentication

tests/web/test_auth.py

@@ -0,0 +1,36 @@
+from fastapi.testclient import TestClient
+
+
+def test_dashboard_redirects_when_not_logged_in(client: TestClient) -> None:
+    response = client.get("/", follow_redirects=False)
+    assert response.status_code == 303
+    assert response.headers["location"] == "/login"
+
+
+def extract_csrf(html: str) -> str:
+    marker = 'name="csrf_token" value="'
+    start = html.index(marker) + len(marker)
+    return html[start:html.index('"', start)]
+
+
+def test_login_rejects_wrong_password(client: TestClient) -> None:
+    login_page = client.get("/login")
+    csrf = extract_csrf(login_page.text)
+    response = client.post(
+        "/login",
+        data={"password": "wrong", "csrf_token": csrf},
+        follow_redirects=False,
+    )
+    assert response.status_code == 401
+
+
+def test_login_accepts_configured_password(client: TestClient) -> None:
+    login_page = client.get("/login")
+    csrf = extract_csrf(login_page.text)
+    response = client.post(
+        "/login",
+        data={"password": "admin-secret", "csrf_token": csrf},
+        follow_redirects=False,
+    )
+    assert response.status_code == 303
+    assert response.headers["location"] == "/"