Add everyone system user for anonymous registry pull.

Reserved PUBLIC ACLs can grant unauthenticated pull while blocking login, deletion, and anonymous push/delete.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/prisma/seed.ts

@@ -1,5 +1,7 @@
 import type { PrismaClient } from '../../generated/prisma/client'
+import { randomUUID } from 'node:crypto'
 import { hashPassword } from '../server/utils/password'
+import { EVERYONE_USERNAME } from '../server/utils/system-users'
 
 type SeedPrisma = Pick<PrismaClient, 'user'>
 
@@ -7,6 +9,10 @@ export async function seedAdmin(prisma: SeedPrisma) {
   const username = process.env.ADMIN_USERNAME || 'admin'
   const password = process.env.ADMIN_PASSWORD || 'admin123'
 
+  if (username.toLowerCase() === EVERYONE_USERNAME) {
+    throw new Error(`ADMIN_USERNAME cannot use reserved username "${EVERYONE_USERNAME}"`)
+  }
+
   const existing = await prisma.user.findUnique({ where: { username } })
   if (existing) {
     return existing
@@ -21,3 +27,28 @@ export async function seedAdmin(prisma: SeedPrisma) {
     },
   })
 }
+
+export async function seedEveryone(prisma: SeedPrisma) {
+  const existing = await prisma.user.findUnique({
+    where: { username: EVERYONE_USERNAME },
+  })
+
+  if (existing) {
+    if (existing.role !== 'USER') {
+      return prisma.user.update({
+        where: { id: existing.id },
+        data: { role: 'USER' },
+      })
+    }
+    return existing
+  }
+
+  return prisma.user.create({
+    data: {
+      username: EVERYONE_USERNAME,
+      passwordHash: await hashPassword(randomUUID()),
+      role: 'USER',
+      active: true,
+    },
+  })
+}