feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

internal/webapp/auth_password_test.go

@@ -0,0 +1,48 @@
+package webapp
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerateFirstRunPassword(t *testing.T) {
+	a, err := GenerateFirstRunPassword()
+	require.NoError(t, err)
+	require.NotEmpty(t, a)
+	// 24 bytes -> 32 base64 chars (RawURLEncoding, no padding).
+	assert.Len(t, a, 32, "first-run password length")
+
+	// Two calls must produce different passwords (statistically
+	// certain with crypto/rand).
+	b, err := GenerateFirstRunPassword()
+	require.NoError(t, err)
+	assert.NotEqual(t, a, b, "two calls must produce distinct passwords")
+}
+
+func TestHashAndVerifyPassword(t *testing.T) {
+	const plain = "correct horse battery staple"
+	hash, err := HashPassword(plain)
+	require.NoError(t, err)
+	require.NotEmpty(t, hash)
+	assert.True(t, strings.HasPrefix(hash, "$2a$"),
+		"bcrypt hash should start with $2a$")
+
+	require.NoError(t, VerifyPassword(hash, plain),
+		"correct password must verify")
+	assert.Error(t, VerifyPassword(hash, "wrong password"),
+		"wrong password must not verify")
+}
+
+func TestHashPasswordRejectsEmpty(t *testing.T) {
+	_, err := HashPassword("")
+	assert.Error(t, err, "empty plaintext must be rejected")
+}
+
+func TestMaskToken(t *testing.T) {
+	assert.Equal(t, "—", MaskToken(""))
+	assert.Equal(t, "****", MaskToken("abcd"))
+	assert.Equal(t, "****wxyz", MaskToken("abcdefghwxyz"))
+}