feat: Implement random password and token generation for tests

tests/test_bootstrap.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 from collections.abc import Callable
-
 from typing import Any
 
 import pytest
@@ -20,6 +19,7 @@ from services.bootstrap import (
 )
 from services.pricing import PricingMetadata
 from services.unit_of_work import UnitOfWork
+from tests.utils.security import random_password
 
 
 @pytest.fixture()
@@ -46,7 +46,7 @@ def _settings(**overrides: Any) -> AdminBootstrapSettings:
     defaults: dict[str, Any] = {
         "email": "admin@example.com",
         "username": "admin",
-        "password": "changeme",
+        "password": random_password(),
         "roles": ("admin", "viewer"),
         "force_reset": False,
     }
@@ -103,11 +103,13 @@ def test_bootstrap_is_idempotent(unit_of_work_factory: Callable[[], UnitOfWork])
 
 
 def test_bootstrap_respects_force_reset(unit_of_work_factory: Callable[[], UnitOfWork]) -> None:
-    base_settings = _settings(password="initial")
+    base_password = random_password()
+    base_settings = _settings(password=base_password)
     bootstrap_admin(settings=base_settings,
                     unit_of_work_factory=unit_of_work_factory)
 
-    rotated_settings = _settings(password="rotated", force_reset=True)
+    rotated_password = random_password()
+    rotated_settings = _settings(password=rotated_password, force_reset=True)
     _, admin_result = bootstrap_admin(
         settings=rotated_settings,
         unit_of_work_factory=unit_of_work_factory,
@@ -121,7 +123,7 @@ def test_bootstrap_respects_force_reset(unit_of_work_factory: Callable[[], UnitO
         assert users_repo is not None
         user = users_repo.get_by_email(rotated_settings.email)
         assert user is not None
-        assert user.verify_password("rotated")
+    assert user.verify_password(rotated_password)
 
 
 def test_bootstrap_pricing_creates_defaults(unit_of_work_factory: Callable[[], UnitOfWork]) -> None: