feat(auth): integrate authentication with installation lifecycle

backend/test/auth.test.ts

@@ -169,7 +169,7 @@ test("the session boundary exposes only exact health and authentication protocol
   expect((await app.inject({ method: "GET", url: "/auth/configured" })).statusCode).toBe(401);
 });
 
-test("the session boundary retains the exact loopback tht maintenance identity in configured auth modes", async () => {
+test("loopback maintenance headers can never mint an administrator in configured auth modes", async () => {
   const app = Fastify();
   app.addHook("preHandler", authenticateSession({ mode: "local" }));
   app.get("/private", async (request) => getPrincipal(request));
@@ -183,8 +183,8 @@ test("the session boundary retains the exact loopback tht maintenance identity i
 
   for (const method of ["GET", "POST"] as const) {
     const response = await app.inject({ method, url: "/private", headers, remoteAddress: "127.0.0.1" });
-    expect(response.statusCode).toBe(200);
-    expect(response.json()).toMatchObject({ issuer: "tht", subject: "tht-maintenance", isAdmin: true });
+    expect(response.statusCode).toBe(503);
+    expect(response.body).not.toContain("tht-maintenance");
   }
 });