feat: harden bootstrap and add tests

src/app/api/bootstrap-user/route.ts

@@ -1,11 +1,18 @@
-import { NextRequest, NextResponse } from 'next/server';
+import { NextResponse } from 'next/server';
 import { createUser } from '@/lib/auth';
 
 export async function POST() {
   try {
-    const user = await createUser('mmendoza', 'W3canbeheroes*-*', 'admin');
+    const username = process.env.BOOTSTRAP_ADMIN_USERNAME || 'mmendoza';
+    const password = process.env.BOOTSTRAP_ADMIN_PASSWORD;
+
+    if (!password) {
+      return NextResponse.json({ error: 'Bootstrap password is not configured' }, { status: 500 });
+    }
+
+    const user = await createUser(username, password, 'admin');
     return NextResponse.json({ ok: true, user: { id: user.id, username: user.username, role: user.role } });
   } catch (err: any) {
-    return NextResponse.json({ error: err.message || 'Failed to create user' }, { status: 500 });
+    return NextResponse.json({ error: err?.message || 'Failed to create bootstrap user' }, { status: 500 });
   }
 }