04/06 remediate some issues

app/__init__.py

@@ -166,13 +166,38 @@ def _seed_settings():
 
 
 def _seed_admin(app):
-    """Create the default admin account if none exists."""
+    """Create the default admin account if none exists.
+
+    Username collision guard
+    -----------------------
+    The seed username is hardcoded to 'admin'. If a user registered with
+    that username before the first admin seed runs (possible when
+    registration_enabled=True on a fresh install), the INSERT would raise
+    an IntegrityError and break application startup.
+
+    We guard against this by checking for username conflicts independently
+    of the role check, and falling back to a derived username when 'admin'
+    is already taken.
+    """
     from app.models import User, UserRole
     if User.query.filter_by(role=UserRole.ADMIN).first():
         return
+
+    # Resolve a safe username — 'admin' is preferred but may already be taken.
+    seed_username = 'admin'
+    if User.query.filter_by(username=seed_username).first():
+        # Derive a unique fallback so startup never fails on a collision.
+        import uuid
+        seed_username = f'admin_{uuid.uuid4().hex[:6]}'
+        app.logger.warning(
+            f'[SEED] Username "admin" is already taken — '
+            f'seeding admin account with username "{seed_username}". '
+            f'Rename via Admin → Users after first login.'
+        )
+
     admin = User(
         email     = app.config['ADMIN_EMAIL'],
-        username  = 'admin',
+        username  = seed_username,
         full_name = 'System Administrator',
         role      = UserRole.ADMIN,
         department= 'IT',
@@ -181,4 +206,4 @@ def _seed_admin(app):
     admin.set_password(app.config['ADMIN_PASSWORD'])
     db.session.add(admin)
     db.session.commit()
-    app.logger.info(f'[SEED] Default admin account created: {admin.email}')
+    app.logger.info(f'[SEED] Default admin account created: {admin.email} (username={seed_username})')