style(ntfy): fix bracket-spacing lint offenses

test/fixtures/admin_users.yml

@@ -1,13 +1,13 @@
 # Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html
 
 one:
-  email: MyString
-  password_digest: MyString
-  name: MyString
+  email: one@example.com
+  password_digest: <%= BCrypt::Password.create("password123") %>
+  name: Admin One
   last_login_at: 2025-10-20 10:51:35
 
 two:
-  email: MyString
-  password_digest: MyString
-  name: MyString
+  email: two@example.com
+  password_digest: <%= BCrypt::Password.create("password123") %>
+  name: Admin Two
   last_login_at: 2025-10-20 10:51:35

test/integration/admin/sessions_flow_test.rb

@@ -0,0 +1,48 @@
+require "test_helper"
+
+class AdminSessionsFlowTest < ActionDispatch::IntegrationTest
+  def setup
+    @admin = AdminUser.create!(name: "Site Admin", email: "admin@example.com", password: "supersecret123")
+  end
+
+  test "login page renders the sign-in form" do
+    get admin_login_path
+    assert_response :success
+    assert_match "MySMSAPio", response.body
+    assert_match "Sign in", response.body
+  end
+
+  test "login page displays the auth error message on failed login" do
+    post admin_login_path, params: { email: "admin@example.com", password: "wrong-password" }
+    assert_response :unprocessable_entity
+    # The critical regression check: the alert must be present in the rendered HTML
+    assert_match "Invalid email or password", response.body
+  end
+
+  test "successful login redirects to the dashboard and shows welcome notice" do
+    post admin_login_path, params: { email: "admin@example.com", password: "supersecret123" }
+    assert_redirected_to admin_dashboard_path
+    follow_redirect!
+    assert_match "Welcome back", response.body
+  end
+
+  test "login is case-insensitive for email" do
+    post admin_login_path, params: { email: "ADMIN@example.com", password: "supersecret123" }
+    assert_redirected_to admin_dashboard_path
+  end
+
+  test "logging out clears the session and shows notice on the login page" do
+    post admin_login_path, params: { email: "admin@example.com", password: "supersecret123" }
+    delete admin_logout_path
+    assert_redirected_to admin_login_path
+    follow_redirect!
+    assert_match "logged out", response.body
+  end
+
+  test "protected admin page redirects to login with an alert" do
+    get admin_dashboard_path
+    assert_redirected_to admin_login_path
+    follow_redirect!
+    assert_match "Please log in to continue", response.body
+  end
+end