Fix static asset fallback and seed default admin

Data/Engine/tests/test_config_environment.py

@@ -63,6 +63,23 @@ def test_static_root_falls_back_to_legacy_source(tmp_path, monkeypatch):
     monkeypatch.delenv("BOREALIS_ROOT", raising=False)
 
 
+def test_static_root_considers_runtime_copy(tmp_path, monkeypatch):
+    """Runtime Server/WebUI copies should be considered when Data assets are missing."""
+
+    runtime_source = tmp_path / "Server" / "WebUI"
+    runtime_source.mkdir(parents=True)
+    (runtime_source / "index.html").write_text("runtime", encoding="utf-8")
+
+    monkeypatch.setenv("BOREALIS_ROOT", str(tmp_path))
+    monkeypatch.delenv("BOREALIS_STATIC_ROOT", raising=False)
+
+    settings = load_environment()
+
+    assert settings.flask.static_root == runtime_source.resolve()
+
+    monkeypatch.delenv("BOREALIS_ROOT", raising=False)
+
+
 def test_resolve_project_root_defaults_to_repository(monkeypatch):
     """The project root should resolve to the repository checkout."""
 

Data/Engine/tests/test_sqlite_migrations.py

@@ -1,3 +1,4 @@
+import hashlib
 import sqlite3
 import unittest
 
@@ -24,6 +25,56 @@ class MigrationTests(unittest.TestCase):
             self.assertIn("scheduled_jobs", tables)
             self.assertIn("scheduled_job_runs", tables)
             self.assertIn("github_token", tables)
+            self.assertIn("users", tables)
+
+            cursor.execute(
+                "SELECT username, role, password_sha512 FROM users WHERE LOWER(username)=LOWER(?)",
+                ("admin",),
+            )
+            row = cursor.fetchone()
+            self.assertIsNotNone(row)
+            if row:
+                self.assertEqual(row[0], "admin")
+                self.assertEqual(row[1].lower(), "admin")
+                self.assertEqual(row[2], hashlib.sha512(b"Password").hexdigest())
+        finally:
+            conn.close()
+
+    def test_ensure_default_admin_promotes_existing_user(self) -> None:
+        conn = sqlite3.connect(":memory:")
+        try:
+            conn.execute(
+                """
+                CREATE TABLE users (
+                    id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    username TEXT UNIQUE NOT NULL,
+                    display_name TEXT,
+                    password_sha512 TEXT,
+                    role TEXT,
+                    last_login INTEGER,
+                    created_at INTEGER,
+                    updated_at INTEGER,
+                    mfa_enabled INTEGER DEFAULT 0,
+                    mfa_secret TEXT
+                )
+                """
+            )
+            conn.execute(
+                "INSERT INTO users (username, display_name, password_sha512, role) VALUES (?, ?, ?, ?)",
+                ("admin", "Custom", "hash", "user"),
+            )
+            conn.commit()
+
+            migrations.ensure_default_admin(conn)
+
+            cursor = conn.cursor()
+            cursor.execute(
+                "SELECT role, password_sha512 FROM users WHERE LOWER(username)=LOWER(?)",
+                ("admin",),
+            )
+            role, password_hash = cursor.fetchone()
+            self.assertEqual(role.lower(), "admin")
+            self.assertEqual(password_hash, "hash")
         finally:
             conn.close()