Admin login pasword changes

app/infrastructure/security.py

@@ -127,6 +127,7 @@ def verify_password(password: str, encoded: str) -> bool:
     """
     if not encoded:
         return False
+    encoded = encoded.strip().strip("'\"")
     try:
         prefix, raw_iterations, raw_salt, raw_digest = encoded.split("$")
         if prefix != _PBKDF2_PREFIX:

app/infrastructure/settings.py

@@ -290,20 +290,20 @@ AUTH_TOKEN_TTL_MINUTES = int(os.getenv("AUTH_TOKEN_TTL_MINUTES", "720"))
 # `make_auth_secrets.py` prints the lines ready to paste.
 #
 # `admin` is required whenever auth is on: without it nobody could sign in.
-AUTH_ADMIN_USERNAME = os.getenv("AUTH_ADMIN_USERNAME", "admin")
+AUTH_ADMIN_USERNAME = os.getenv("AUTH_ADMIN_USERNAME", "admin").strip().strip("'\"")
 AUTH_ADMIN_PASSWORD_HASH = (
     _require("AUTH_ADMIN_PASSWORD_HASH", feature_flag="AUTH_ENABLED")
     if AUTH_ENABLED
     else os.getenv("AUTH_ADMIN_PASSWORD_HASH", "")
-)
+).strip().strip("'\"")
 
 # The second `user` account is OPTIONAL, and left unset in this deployment.
 # An empty hash is how the account is switched off: auth.py builds its account
 # table from these values and omits any entry whose hash is blank, so there is
 # nothing to sign in to. Setting the hash again re-enables it with no code
 # change - which is exactly what the test suite does in tests/conftest.py.
-AUTH_USER_USERNAME = os.getenv("AUTH_USER_USERNAME", "user")
-AUTH_USER_PASSWORD_HASH = os.getenv("AUTH_USER_PASSWORD_HASH", "")
+AUTH_USER_USERNAME = os.getenv("AUTH_USER_USERNAME", "user").strip().strip("'\"")
+AUTH_USER_PASSWORD_HASH = os.getenv("AUTH_USER_PASSWORD_HASH", "").strip().strip("'\"")
 
 # Failed-login throttle, applied per username+client-IP. Prevents an exposed
 # login endpoint from being a free password oracle.