feat(meals): enforce three lower-calorie dinners with media

backend/tests/test_auth.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 import os
 
 import pytest
+from starlette.requests import Request
 
 
 # Configure auth secrets BEFORE app import. conftest.py runs first and sets
@@ -39,6 +40,21 @@ def _reload_settings(monkeypatch):
 # ---------------------------------------------------------------------------
 # Admin bearer token
 # ---------------------------------------------------------------------------
+def test_admin_principal_defaults_when_email_is_unset(monkeypatch):
+    from app import security
+
+    monkeypatch.setattr(security.settings, "ADMIN_TOKEN", "test-admin-token")
+    monkeypatch.setattr(security.settings, "ADMIN_EMAIL", None)
+    request = Request(
+        {
+            "type": "http",
+            "headers": [(b"authorization", b"Bearer test-admin-token")],
+        }
+    )
+
+    assert security.require_admin(request) == "admin"
+
+
 @pytest.mark.requires_postgres
 def test_admin_requires_token(client):
     """No bearer → 401. Valid bearer → not 401 (handler runs)."""