preserve Tower Authentik operator login WIP

backend/tests/test_auth.py

@@ -80,6 +80,7 @@ def test_auth_session_and_health_are_public_but_api_is_protected(monkeypatch) ->
         "expires_at": None,
         "role": None,
         "guest_access_enabled": False,
+        "authentik_enabled": False,
         "guest_project_id": None,
     }
     assert protected.status_code == 401
@@ -113,6 +114,7 @@ def test_login_uses_http_only_session_cookie_and_logout_revokes_browser_access(m
         "expires_at": login.json()["data"]["expires_at"],
         "role": "operator",
         "guest_access_enabled": True,
+        "authentik_enabled": False,
         "guest_project_id": None,
     }
     cookie = login.headers["set-cookie"].lower()
@@ -223,6 +225,7 @@ def test_unraid_runtime_carries_only_hashed_operator_credentials() -> None:
     browser_smoke = (root / "scripts/verify_browser_runtime.sh").read_text(encoding="utf-8")
 
     assert '-e GEOINTEL_AUTH_PASSWORD_HASH="$GEOINTEL_AUTH_PASSWORD_HASH"' in runner
+    assert '-e GEOINTEL_AUTHENTIK_CLIENT_SECRET="$GEOINTEL_AUTHENTIK_CLIENT_SECRET"' in runner
     assert "GEOINTEL_AUTH_PASSWORD_HASH=" in example
     assert "GEOINTEL_AUTH_PASSWORD=" not in runner
     assert "GEOINTEL_GUEST_ACCESS_ENABLED=true" in example