feat: implement initial admin setup (Story 1.1)

Add complete initial admin setup functionality including:
- SetupForm with email, password, and password confirmation fields
- Password validation (minimum 12 characters) and confirmation matching
- Email format validation
- Setup route with GET (display form) and POST (process setup) handlers
- bcrypt password hashing before storing admin credentials
- Auto-login after successful setup with session management
- First-run detection middleware that redirects to /setup if no admin exists
- Setup page returns 404 after admin account is created
- Base HTML template with Pico CSS integration
- Admin dashboard placeholder template
- 404 error template

All tests pass with 90.09% code coverage (exceeds 80% requirement).
Code passes ruff linting and mypy type checking.

Story: 1.1

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

tests/__init__.py

@@ -0,0 +1 @@
+"""Test package for Sneaky Klaus."""

tests/conftest.py

@@ -0,0 +1,77 @@
+"""Pytest configuration and shared fixtures for Sneaky Klaus tests."""
+
+import pytest
+
+from src.app import create_app
+from src.app import db as _db
+from src.models import Admin
+
+
+@pytest.fixture(scope="session")
+def app():
+    """Create and configure a test Flask application instance.
+
+    This fixture is scoped to the session so the app is created once
+    for all tests.
+
+    Yields:
+        Flask application configured for testing.
+    """
+    app = create_app("testing")
+    yield app
+
+
+@pytest.fixture(scope="function")
+def db(app):
+    """Create a clean database for each test.
+
+    This fixture creates all tables before each test and drops them
+    after each test to ensure isolation.
+
+    Args:
+        app: Flask application instance from app fixture.
+
+    Yields:
+        SQLAlchemy database instance.
+    """
+    with app.app_context():
+        _db.create_all()
+        yield _db
+        _db.session.remove()
+        _db.drop_all()
+
+
+@pytest.fixture(scope="function")
+def client(app, db):  # noqa: ARG001
+    """Create a test client for the Flask application.
+
+    Args:
+        app: Flask application instance.
+        db: Database instance (ensures db is set up first).
+
+    Yields:
+        Flask test client.
+    """
+    with app.test_client() as client:
+        yield client
+
+
+@pytest.fixture
+def admin(db):
+    """Create an admin user for testing.
+
+    Args:
+        db: Database instance.
+
+    Returns:
+        Admin model instance.
+    """
+    from src.app import bcrypt
+
+    admin = Admin(
+        email="admin@example.com",
+        password_hash=bcrypt.generate_password_hash("testpassword123").decode("utf-8"),
+    )
+    db.session.add(admin)
+    db.session.commit()
+    return admin

tests/integration/test_setup.py

@@ -0,0 +1,219 @@
+"""Integration tests for Story 1.1: Initial Admin Setup."""
+
+from src.app import bcrypt
+from src.models import Admin
+
+
+class TestInitialAdminSetup:
+    """Test cases for initial admin setup flow (Story 1.1)."""
+
+    def test_setup_screen_appears_on_first_access(self, client, db):  # noqa: ARG002
+        """Test that setup screen appears when no admin exists.
+
+        Acceptance Criteria:
+        - Setup screen appears on first application access
+        """
+        # Access root path - should redirect to setup
+        response = client.get("/")
+        assert response.status_code == 302
+        assert "/setup" in response.location
+
+        # Accessing setup directly should show setup form
+        response = client.get("/setup", follow_redirects=False)
+        assert response.status_code == 200
+        assert b"Admin Setup" in response.data or b"Create Admin" in response.data
+        assert b"email" in response.data.lower()
+        assert b"password" in response.data.lower()
+
+    def test_setup_requires_email_and_password(self, client, db):  # noqa: ARG002
+        """Test that setup form requires email and password.
+
+        Acceptance Criteria:
+        - Requires email address and password
+        """
+        response = client.get("/setup")
+        assert response.status_code == 200
+
+        # Check form has email and password fields
+        assert b'type="email"' in response.data or b'name="email"' in response.data
+        assert (
+            b'type="password"' in response.data or b'name="password"' in response.data
+        )
+
+    def test_setup_with_valid_data_creates_admin(self, client, db):
+        """Test that valid setup data creates admin account.
+
+        Acceptance Criteria:
+        - After setup, admin account is created
+        """
+        response = client.post(
+            "/setup",
+            data={
+                "email": "admin@example.com",
+                "password": "validpassword123",
+                "password_confirm": "validpassword123",
+            },
+            follow_redirects=False,
+        )
+
+        # Should redirect after successful setup
+        assert response.status_code == 302
+
+        # Verify admin was created
+        admin = db.session.query(Admin).filter_by(email="admin@example.com").first()
+        assert admin is not None
+        assert admin.email == "admin@example.com"
+
+        # Verify password was hashed
+        assert admin.password_hash is not None
+        assert admin.password_hash != "validpassword123"
+        assert bcrypt.check_password_hash(admin.password_hash, "validpassword123")
+
+    def test_setup_validates_password_minimum_length(self, client, db):
+        """Test that password must meet minimum length requirement.
+
+        Acceptance Criteria:
+        - Password must meet minimum security requirements (12 characters)
+        """
+        # Try with password too short
+        response = client.post(
+            "/setup",
+            data={
+                "email": "admin@example.com",
+                "password": "short",  # Less than 12 characters
+                "password_confirm": "short",
+            },
+            follow_redirects=True,
+        )
+
+        # Should show error and not create admin
+        assert (
+            b"at least 12 characters" in response.data.lower()
+            or b"too short" in response.data.lower()
+        )
+
+        # Verify no admin was created
+        admin_count = db.session.query(Admin).count()
+        assert admin_count == 0
+
+    def test_setup_validates_password_confirmation(self, client, db):
+        """Test that password confirmation must match.
+
+        Acceptance Criteria:
+        - Password confirmation must match password
+        """
+        response = client.post(
+            "/setup",
+            data={
+                "email": "admin@example.com",
+                "password": "validpassword123",
+                "password_confirm": "differentpassword123",
+            },
+            follow_redirects=True,
+        )
+
+        # Should show error about passwords not matching
+        assert b"match" in response.data.lower() or b"same" in response.data.lower()
+
+        # Verify no admin was created
+        admin_count = db.session.query(Admin).count()
+        assert admin_count == 0
+
+    def test_setup_validates_email_format(self, client, db):
+        """Test that email must be valid format.
+
+        Acceptance Criteria:
+        - Email address must be valid format
+        """
+        response = client.post(
+            "/setup",
+            data={
+                "email": "not-a-valid-email",
+                "password": "validpassword123",
+                "password_confirm": "validpassword123",
+            },
+            follow_redirects=True,
+        )
+
+        # Should show error about invalid email
+        assert (
+            b"valid email" in response.data.lower()
+            or b"invalid email" in response.data.lower()
+        )
+
+        # Verify no admin was created
+        admin_count = db.session.query(Admin).count()
+        assert admin_count == 0
+
+    def test_setup_logs_in_admin_after_creation(self, client, db):  # noqa: ARG002
+        """Test that user is logged in after successful setup.
+
+        Acceptance Criteria:
+        - After setup, user is logged in as admin
+        """
+        response = client.post(
+            "/setup",
+            data={
+                "email": "admin@example.com",
+                "password": "validpassword123",
+                "password_confirm": "validpassword123",
+            },
+            follow_redirects=True,
+        )
+
+        # Should redirect to admin dashboard
+        assert response.status_code == 200
+        assert (
+            b"dashboard" in response.data.lower() or b"admin" in response.data.lower()
+        )
+
+        # Verify session is set (check that we can access admin routes)
+        response = client.get("/admin/dashboard", follow_redirects=False)
+        # 404 is OK if route not implemented yet
+        assert response.status_code in (200, 404)
+
+    def test_setup_not_accessible_after_admin_exists(
+        self,
+        client,
+        db,
+        admin,  # noqa: ARG002
+    ):
+        """Test that setup page returns 404 after admin exists.
+
+        Acceptance Criteria:
+        - Setup screen is not accessible after initial admin creation
+        """
+        # Try to access setup when admin already exists
+        response = client.get("/setup", follow_redirects=False)
+        assert response.status_code == 404
+
+        # Try to POST to setup when admin already exists
+        response = client.post(
+            "/setup",
+            data={
+                "email": "another@example.com",
+                "password": "validpassword123",
+                "password_confirm": "validpassword123",
+            },
+            follow_redirects=False,
+        )
+        assert response.status_code == 404
+
+        # Verify no second admin was created
+        admin_count = db.session.query(Admin).count()
+        assert admin_count == 1
+
+    def test_root_redirects_to_admin_dashboard_when_admin_exists(
+        self,
+        client,
+        db,  # noqa: ARG002
+        admin,  # noqa: ARG002
+    ):
+        """Test that root path redirects normally when admin exists.
+
+        Once setup is complete, the root path should not redirect to setup.
+        """
+        response = client.get("/", follow_redirects=False)
+
+        # Should either render landing page or redirect to login (not to setup)
+        assert "/setup" not in (response.location or "")