fis_admin_getUserAccount always inserted a result row, even when no
matching user was found, so fis_admin_authenticate never truly
returned "no result" on wrong credentials — the login handler then
signed the caller in with an empty useraccount_id. The authenticated
shell rendered (IsAuthenticated only checks the claim exists), while
every data endpoint 401'd (FuchsUserIdentity.IsAuthenticated also
checks the id is non-empty), producing an empty portal.
Also treat an empty useraccount_id in HandleLogin as a failed login
(defense in depth) and fix a column-name mismatch (auth vs
authorization) that was silently zeroing the authorization level.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
