feat(server): randomize the seeded admin initial password (#172)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

packages/server/test/config.test.ts

@@ -1,9 +1,12 @@
 /**
- * resolveServerConfig PORT parsing tests: both the default (missing) and empty string
- * (the common `PORT=` empty value in `.env`) fall back to 7364 — Number("") === 0 used
- * to make the empty string pass range validation and bind to a random port; explicit
- * "0" is preserved (explicit semantics for a random available port); invalid values
- * throw. This matches the CLI's resolvePort semantics (packages/cli serve).
+ * resolveServerConfig parsing tests.
+ *
+ * PORT: both the default (missing) and empty string (the common `PORT=` empty value in
+ * `.env`) fall back to 7364 — Number("") === 0 used to make the empty string pass range
+ * validation and bind to a random port; explicit "0" is preserved (explicit semantics
+ * for a random available port); invalid values throw. This matches the CLI's
+ * resolvePort semantics (packages/cli serve).
+ * PENGUIN_SEED_ADMIN_PASSWORD: unset/empty/whitespace → null (random seed password).
  */
 import { describe, expect, it } from "vitest";
 import { resolveServerConfig } from "../src/config.js";
@@ -27,3 +30,19 @@ describe("resolveServerConfig: PORT parsing", () => {
     }
   });
 });
+
+describe("resolveServerConfig: PENGUIN_SEED_ADMIN_PASSWORD parsing", () => {
+  it("unset/empty/whitespace → null; a value is kept trimmed", () => {
+    expect(resolveServerConfig({ ...base }).seedAdminPassword).toBeNull();
+    expect(
+      resolveServerConfig({ ...base, PENGUIN_SEED_ADMIN_PASSWORD: "" }).seedAdminPassword,
+    ).toBeNull();
+    expect(
+      resolveServerConfig({ ...base, PENGUIN_SEED_ADMIN_PASSWORD: "  " }).seedAdminPassword,
+    ).toBeNull();
+    expect(
+      resolveServerConfig({ ...base, PENGUIN_SEED_ADMIN_PASSWORD: " penguin-9999 " })
+        .seedAdminPassword,
+    ).toBe("penguin-9999");
+  });
+});