Refactor auth and setup services

- Updated auth_service.py to improve authentication logic
- Modified setup_service.py for better configuration handling
- Added comprehensive tests for setup_service
- Updated documentation in Tasks.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

backend/app/services/auth_service.py

@@ -21,15 +21,18 @@ if TYPE_CHECKING:
     import aiosqlite
 
     from app.models.auth import Session
-    from app.repositories.protocols import SessionRepository
+    from app.repositories.protocols import SessionRepository, SettingsRepository
 
 from app.repositories import session_repo as default_session_repo
-from app.services.setup_service import get_password_hash
+from app.repositories import settings_repo as default_settings_repo
 from app.utils.constants import SESSION_TOKEN_BYTES, SESSION_TOKEN_SIGNATURE_SEPARATOR
 from app.utils.time_utils import add_minutes, utc_now
 
 log: structlog.stdlib.BoundLogger = structlog.get_logger()
 
+# Settings key for password hash
+_KEY_PASSWORD_HASH = "master_password_hash"
+
 
 def _session_token_signature(token: str, secret: str) -> str:
     """Return the HMAC-SHA256 signature for a session token."""
@@ -85,6 +88,22 @@ async def _check_password(plain: str, hashed: str) -> bool:
     return await run_blocking(lambda: bool(bcrypt.checkpw(plain_bytes, hashed_bytes)))
 
 
+async def get_password_hash(
+    db: aiosqlite.Connection,
+    settings_repo: SettingsRepository = default_settings_repo,
+) -> str | None:
+    """Return the stored bcrypt password hash, or ``None`` if not set.
+
+    Args:
+        db: Active aiosqlite connection.
+        settings_repo: Repository interface for settings persistence.
+
+    Returns:
+        The stored bcrypt hash string, or ``None`` if not configured.
+    """
+    return await settings_repo.get_setting(db, _KEY_PASSWORD_HASH)
+
+
 async def login(
     db: aiosqlite.Connection,
     password: str,

backend/app/services/setup_service.py

@@ -208,14 +208,6 @@ async def run_setup(
     log.info("bangui_setup_completed")
 
 
-async def get_password_hash(
-    db: aiosqlite.Connection,
-    settings_repo: SettingsRepository = default_settings_repo,
-) -> str | None:
-    """Return the stored bcrypt password hash, or ``None`` if not set."""
-    return await settings_repo.get_setting(db, _KEY_PASSWORD_HASH)
-
-
 async def get_runtime_database_path(
     db: aiosqlite.Connection,
     settings_repo: SettingsRepository = default_settings_repo,