Dave 2401dbd68f test(ai): settings page never exposes the API key ... Three tests cover the storage and access boundary: - A client manager cannot list the settings collection at all (rules are superuser-only — verified by the rejection, not by silent skip). - The settings page HTML returned to the owner does not contain the key value, even when the key is freshly set to a unique sentinel. - A client manager gets 404 on /admin/settings (admin layout gates on role, not on session presence). helpers.ts gained ownerEmail / ownerPassword — needed by the settings test and reusable for any owner-only integration test going forward.		2026-09-16 15:59:49 +02:00
..
integration	test(ai): settings page never exposes the API key	2026-09-16 15:59:49 +02:00