feat: add conditional bootstrap login + 23 admin login tests

- Add hash_password/verify_password to app/auth.py using bcrypt
- Fix /login to reject bootstrap creds (403) when admin users exist
- Add normal password-based login path for existing admin users
- Eagerly load User.roles to avoid lazy-load outside async session
- Fix test_user_models.py VARCHAR assertion (SQLAlchemy 2.0 uses 'string')
- Use shared-cache SQLite in conftest for endpoint-level tests
- Add 23 tests covering all 3 required scenarios plus edge cases:
  1. Bootstrap login with hardcoded creds when no admins → PASS (200)
  2. Bootstrap login with hardcoded creds when admins exist → FAIL (403)
  3. Password login for existing admin with hashed password → PASS (200)
- All 130 tests pass (107 existing + 23 new)

backend/tests/test_user_models.py

@@ -13,7 +13,7 @@ class TestRoleModel:
 
     def test_role_has_name_column(self):
         col = Role.__table__.columns["name"]
-        assert col.type.__visit_name__ == "VARCHAR"
+        assert col.type.__visit_name__ in ("VARCHAR", "string")
 
     def test_role_name_is_unique(self):
         col = Role.__table__.columns["name"]