fix: generate test config.yml in conftest for CI

Login route reads config.yml for credentials but it is gitignored.
Session-scoped autouse fixture now writes a minimal config.yml to a
temp path and patches settings.config_path so test_scan.py auth
fixtures work in CI without a real config file.

backend/tests/conftest.py

@@ -4,7 +4,9 @@ import os
 os.environ.setdefault("SECRET_KEY", "test-only-secret-key-not-for-production")
 
 import pytest
+import yaml
 from httpx import ASGITransport, AsyncClient
+from passlib.context import CryptContext
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 
 from app.db.database import Base, get_db
@@ -12,6 +14,25 @@ from app.main import app
 
 TEST_DB_URL = "sqlite+aiosqlite:///:memory:"
 
+_pwd_ctx = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+
+@pytest.fixture(autouse=True, scope="session")
+def test_config_file(tmp_path_factory):
+    """Write a minimal config.yml for the test session and point settings at it."""
+    cfg = {
+        "auth": {
+            "username": "admin",
+            "password_hash": _pwd_ctx.hash("admin"),
+        },
+        "scanner": {"ranges": []},
+        "status_checker": {"interval_seconds": 3600},
+    }
+    cfg_path = tmp_path_factory.mktemp("cfg") / "config.yml"
+    cfg_path.write_text(yaml.dump(cfg))
+    from app.core.config import settings
+    settings.config_path = str(cfg_path)
+
 
 @pytest.fixture
 async def db_session():