fix(security): seed demo account as user, not admin (P4.4)

server/prisma/seed.js

@@ -357,7 +357,7 @@ export async function seed(prisma) {
       email: DEMO_USER_EMAIL,
       passwordHash,
       name: 'Demo User',
-      role: 'admin',
+      role: 'user',
     },
   });
 

server/prisma/seed.test.js

@@ -1,8 +1,10 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, beforeEach } from 'vitest';
 import { readFileSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createFakePrismaClient } from '../test-utils/fakePrismaClient.js';
+import { seed } from './seed.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const seedFilePath = path.join(__dirname, 'seed.js');
@@ -40,3 +42,19 @@ describe('seed.js guard clause', () => {
     expect(error).toBeDefined();
   });
 });
+
+describe('seed function', () => {
+  let prisma;
+
+  beforeEach(() => {
+    prisma = createFakePrismaClient();
+  });
+
+  it('should create a demo user with role "user"', async () => {
+    const { user } = await seed(prisma);
+
+    expect(user).toBeDefined();
+    expect(user.email).toBe('demo@lexforge.app');
+    expect(user.role).toBe('user');
+  });
+});

server/test-utils/fakePrismaClient.js

@@ -118,6 +118,14 @@ function createFakeModel({ uniqueFields = [] } = {}) {
       for (const record of matches) rows.delete(record.id);
       return { count: matches.length };
     },
+
+    async upsert({ where, create, update }) {
+      const existing = await this.findUnique({ where });
+      if (existing) {
+        return this.update({ where, data: update || {} });
+      }
+      return this.create({ data: create });
+    },
   };
 }