owain
e0ddc4cbf4
_get_pocketid_config / _get_allowed_group selected an admin row with an unordered LIMIT 1. With more than one admin (e.g. the seeded password admin plus a passkey-linked admin), this non-deterministically returned an admin without PocketID config — making the passkey button disappear (available=false) and group gating inconsistent. Add _config_admin() which prefers the admin that actually has an issuer set, then falls back to the lowest-id admin. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>