fix(#480): hard-delete the seed artefacts instead of parking them in the Trash

[guycorbaz]

Closes #480.

The residue

The #173 seed gate soft-deleted the admin / librarian rows whose password_hash still matched the documented seed value. That was enough to fire the wizard and to stop admin/admin from logging in, but it left two things behind:

1. The seeded rows stayed recoverable for the 30 days before auto-purge — one UPDATE users SET deleted_at = NULL away. The Trash panel's Restore button is that UPDATE. Once [CR] The Trash panel's Restore button points at a route that does not exist #478 wires the missing route, an administrator who sees admin and librarian in the Trash and restores them — reasonably, believing a predecessor deleted them — gets back a live administrator whose password is published in this repository's own SECURITY.md.
2. The seeded sessions row was never touched. Its token is published in CLAUDE.md, in the E2E helpers and in the git history. Inert today on two counts, which is one count more than it should need.

This is the change #480 says must land before #478.

The change

seed_gate::apply_with now runs one transaction:

• delete the sessions — by the published token, and by user_id of any seeded row (fk_sessions_user has no CASCADE, so this ordering is required, not cosmetic);
• delete the user rows outright.

admin_audit.user_id and api_keys.created_by are ON DELETE SET NULL (#69 / #70), so audit history survives detached — an integration test pins that.

Two deliberate choices:

• No deleted_at filter. An instance upgrading from v1.18.0 or earlier carries rows its old gate soft-deleted; the first boot on this version purges them too.
• The hash guard is unchanged. An operator who rotated the seeded password keeps their row, live. The published session token goes regardless of whose row it points at — the value itself is public.

One consequence worth stating: an operator who has been running with MYBIBLI_SEED_DEV_USERS=1 and then unsets it no longer gets the seeded admin back from the Trash. That is the point of the issue; the wizard fires and they create a real admin.

Coverage

Rust — tests/seed_gate.rs moves from "both rows are soft-deleted" to "both rows are gone", plus: the published token is removed; a second session of a seeded user goes with the user; the audit row is detached, not cascaded; rows an older version soft-deleted are purged on the next boot; and the rotated-password and idempotence properties still hold.

Browser — the e2e-wizard CI lane no longer wipes users and sessions with raw SQL. docker-compose.wizard.yml unsets MYBIBLI_SEED_DEV_USERS, so the gate itself clears them during the boot the lane already waits for. Wiping by hand would have hidden a broken gate; letting the gate do it makes that lane the end-to-end proof that a fresh production install starts clean. The wizard smoke spec then asserts what an operator actually sees: an empty Trash panel, and the published session cookie no longer authenticating (/admin bounces to /login).

Docs (README.md, .env.example, CLAUDE.md) say hard-delete where they said soft-delete.

Testing

Run locally against the wizard stack and the test MariaDB:

• cargo clippy --all-targets -- -D warnings — clean.
• cargo test --lib — 1171 passed.
• cargo test --tests --no-fail-fast — 31 binaries, 204 tests, all green.
• Wizard stack boot log: removed_count=2, sessions_removed=1; sessions empty, only SYSTEM left in users.
• MYBIBLI_SETUP_E2E=1 npx playwright test specs/journeys/setup-wizard.spec.ts — passed against that stack.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D5cV9QRqQAFpiNKZwZfoNX