Remove repository import from setup_utils and move password-hash helper to setup service

Docs/Tasks.md

@@ -195,6 +195,8 @@ Reference: `Docs/Refactoring.md` for full analysis of each issue.
 
 **Why this is needed:** Utils are stateless helpers with no external dependencies. Allowing them to import from the repository layer breaks the architectural contract, makes the utilities untestable without a database, and obscures what is actually a service-layer operation.
 
+**Status:** Completed ✅
+
 ---
 
 ### Task 11 — Centralise `DbDep` — remove local redefinitions in `blocklist.py` and `geo.py`

backend/app/services/auth_service.py

@@ -24,8 +24,8 @@ if TYPE_CHECKING:
     from app.repositories.protocols import SessionRepository
 
 from app.repositories import session_repo as default_session_repo
+from app.services.setup_service import get_password_hash
 from app.utils.constants import SESSION_TOKEN_BYTES, SESSION_TOKEN_SIGNATURE_SEPARATOR
-from app.utils.setup_utils import get_password_hash
 from app.utils.time_utils import add_minutes, utc_now
 
 log: structlog.stdlib.BoundLogger = structlog.get_logger()

backend/app/services/setup_service.py

@@ -22,9 +22,6 @@ from app.services.settings_service import (
     set_map_color_thresholds as util_set_map_color_thresholds,
 )
 from app.utils.async_utils import run_blocking
-from app.utils.setup_utils import (
-    get_password_hash as util_get_password_hash,
-)
 
 if TYPE_CHECKING:
     import aiosqlite
@@ -131,7 +128,7 @@ async def run_setup(
 
 async def get_password_hash(db: aiosqlite.Connection) -> str | None:
     """Return the stored bcrypt password hash, or ``None`` if not set."""
-    return await util_get_password_hash(db)
+    return await settings_repo.get_setting(db, _KEY_PASSWORD_HASH)
 
 
 async def get_runtime_database_path(db: aiosqlite.Connection) -> str | None:

backend/app/utils/setup_utils.py

@@ -1,13 +1,3 @@
 """Setup-related utilities shared by multiple services."""
 
 from __future__ import annotations
-
-from app.repositories import settings_repo
-
-_KEY_PASSWORD_HASH = "master_password_hash"
-_KEY_SETUP_DONE = "setup_completed"
-
-
-async def get_password_hash(db):
-    """Return the stored master password hash or None."""
-    return await settings_repo.get_setting(db, _KEY_PASSWORD_HASH)