Initial implementation of inventree

A small IT asset inventory system built around a nested folder tree,
matching the project brief: Go + html/template + Bootstrap 5 + vanilla JS,
SQLite storage (WAL, FKs, migrations), embedded templates/static assets,
single compiled binary.

- AJAX-driven inventory tree: lazy-loaded folder expansion with per-user
  persisted expand state, drag-and-drop move for folders/assets, safe
  delete-with-relocate-or-cascade confirmation, search with breadcrumbs.
- Assets: CRUD, duplicate, move, auto-generated IT-000001-style IDs,
  CSV import (with optional folder auto-create) and export.
- Admin-defined item types with custom fields (text/long_text/number/date/
  boolean/dropdown/url/ip_address).
- Configurable statuses, session-based auth (bcrypt, secure cookies),
  admin/user roles, user management.
- CLI: serve, version, database migrate, database backup; /healthz;
  graceful shutdown; Dockerfile/docker-compose/systemd unit; Go test suite.

internal/users/users_test.go

@@ -0,0 +1,96 @@
+package users_test
+
+import (
+	"context"
+	"database/sql"
+	"path/filepath"
+	"testing"
+
+	"inventree/internal/database"
+	"inventree/internal/models"
+	"inventree/internal/users"
+)
+
+func testDB(t *testing.T) *sql.DB {
+	t.Helper()
+	dir := t.TempDir()
+	db, err := database.Open(filepath.Join(dir, "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+	return db
+}
+
+func TestDefaultAdminSeeded(t *testing.T) {
+	ctx := context.Background()
+	s := users.NewStore(testDB(t))
+
+	u, err := s.Authenticate(ctx, "admin", "admin")
+	if err != nil {
+		t.Fatalf("authenticate default admin: %v", err)
+	}
+	if !u.IsAdmin() {
+		t.Fatal("expected default admin to have admin role")
+	}
+}
+
+func TestAuthenticateRejectsBadPassword(t *testing.T) {
+	s := users.NewStore(testDB(t))
+	if _, err := s.Authenticate(context.Background(), "admin", "wrong"); err == nil {
+		t.Fatal("expected authentication to fail")
+	}
+}
+
+func TestCreateUserRejectsDuplicateUsername(t *testing.T) {
+	ctx := context.Background()
+	s := users.NewStore(testDB(t))
+
+	u := &models.User{Username: "admin", Role: models.RoleUser, Enabled: true}
+	if err := s.Create(ctx, u, "whatever"); err != users.ErrUsernameTaken {
+		t.Fatalf("expected ErrUsernameTaken, got %v", err)
+	}
+}
+
+func TestCannotRemoveLastAdmin(t *testing.T) {
+	ctx := context.Background()
+	s := users.NewStore(testDB(t))
+
+	admin, err := s.GetByUsername(ctx, "admin")
+	if err != nil {
+		t.Fatalf("get admin: %v", err)
+	}
+
+	if err := s.Delete(ctx, admin.ID); err != users.ErrLastAdmin {
+		t.Fatalf("expected ErrLastAdmin on delete, got %v", err)
+	}
+
+	admin.Enabled = false
+	if err := s.Update(ctx, admin); err != users.ErrLastAdmin {
+		t.Fatalf("expected ErrLastAdmin on disable, got %v", err)
+	}
+
+	admin.Role = models.RoleUser
+	admin.Enabled = true
+	if err := s.Update(ctx, admin); err != users.ErrLastAdmin {
+		t.Fatalf("expected ErrLastAdmin on demote, got %v", err)
+	}
+}
+
+func TestSecondAdminAllowsRemovingFirst(t *testing.T) {
+	ctx := context.Background()
+	s := users.NewStore(testDB(t))
+
+	second := &models.User{Username: "second-admin", Role: models.RoleAdmin, Enabled: true}
+	if err := s.Create(ctx, second, "password123"); err != nil {
+		t.Fatalf("create second admin: %v", err)
+	}
+
+	admin, err := s.GetByUsername(ctx, "admin")
+	if err != nil {
+		t.Fatalf("get admin: %v", err)
+	}
+	if err := s.Delete(ctx, admin.ID); err != nil {
+		t.Fatalf("expected delete to succeed with a second admin present: %v", err)
+	}
+}