Initial implementation of inventree

A small IT asset inventory system built around a nested folder tree,
matching the project brief: Go + html/template + Bootstrap 5 + vanilla JS,
SQLite storage (WAL, FKs, migrations), embedded templates/static assets,
single compiled binary.

- AJAX-driven inventory tree: lazy-loaded folder expansion with per-user
  persisted expand state, drag-and-drop move for folders/assets, safe
  delete-with-relocate-or-cascade confirmation, search with breadcrumbs.
- Assets: CRUD, duplicate, move, auto-generated IT-000001-style IDs,
  CSV import (with optional folder auto-create) and export.
- Admin-defined item types with custom fields (text/long_text/number/date/
  boolean/dropdown/url/ip_address).
- Configurable statuses, session-based auth (bcrypt, secure cookies),
  admin/user roles, user management.
- CLI: serve, version, database migrate, database backup; /healthz;
  graceful shutdown; Dockerfile/docker-compose/systemd unit; Go test suite.

internal/auth/auth_test.go

@@ -0,0 +1,63 @@
+package auth_test
+
+import (
+	"context"
+	"database/sql"
+	"path/filepath"
+	"testing"
+
+	"inventree/internal/auth"
+	"inventree/internal/database"
+	"inventree/internal/users"
+)
+
+func testDB(t *testing.T) *sql.DB {
+	t.Helper()
+	dir := t.TempDir()
+	db, err := database.Open(filepath.Join(dir, "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+	return db
+}
+
+func TestSessionLifecycle(t *testing.T) {
+	ctx := context.Background()
+	db := testDB(t)
+	userStore := users.NewStore(db)
+	authStore := auth.NewStore(db, userStore)
+
+	admin, err := userStore.GetByUsername(ctx, "admin")
+	if err != nil {
+		t.Fatalf("get admin: %v", err)
+	}
+
+	token, _, err := authStore.CreateSession(ctx, admin.ID)
+	if err != nil {
+		t.Fatalf("create session: %v", err)
+	}
+
+	u, err := authStore.UserForToken(ctx, token)
+	if err != nil {
+		t.Fatalf("resolve session: %v", err)
+	}
+	if u.Username != "admin" {
+		t.Fatalf("expected admin, got %s", u.Username)
+	}
+
+	if err := authStore.DestroySession(ctx, token); err != nil {
+		t.Fatalf("destroy session: %v", err)
+	}
+	if _, err := authStore.UserForToken(ctx, token); err != auth.ErrNoSession {
+		t.Fatalf("expected ErrNoSession after destroy, got %v", err)
+	}
+}
+
+func TestUserForTokenRejectsUnknownToken(t *testing.T) {
+	db := testDB(t)
+	authStore := auth.NewStore(db, users.NewStore(db))
+	if _, err := authStore.UserForToken(context.Background(), "does-not-exist"); err != auth.ErrNoSession {
+		t.Fatalf("expected ErrNoSession, got %v", err)
+	}
+}