fix(auth): prevent None==None admin credential bypass creating phantom admin user

When ADMIN_USERNAME/ADMIN_PASSWORD env vars are not configured, settings
values are None. Python's `None == None` evaluates to True, so any login
request omitting those form fields was authenticated as admin — creating a
phantom 'None@local.docuelevate' profile with admin rights and business plan.

Guard the admin credential check to require both values to be truthy
(non-None, non-empty) before attempting the comparison.

Adds three regression tests covering: both None, both empty-string, and
only password None scenarios.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/auth.py

@@ -324,7 +324,17 @@ async def auth(request: Request, db: Session = Depends(get_db)):
             return RedirectResponse(url=redirect_url, status_code=302)
 
     # --- Admin credentials (always available as a fallback / single-user mode) ---
-    if username == settings.admin_username and password == settings.admin_password:
+    # Guard: only attempt the match when credentials are actually configured.
+    # Without this guard, Python's `None == None` would be True when neither
+    # ADMIN_USERNAME nor ADMIN_PASSWORD is set, allowing any request that omits
+    # those form fields to be authenticated as an admin — creating a phantom
+    # "None@local.docuelevate" admin profile with full privileges.
+    if (
+        settings.admin_username
+        and settings.admin_password
+        and username == settings.admin_username
+        and password == settings.admin_password
+    ):
         admin_user_data = {
             "id": "admin",
             "name": "Administrator",