fix: create system account for service user to satisfy account_id NOT NULL on prod (#91)

The prod users table has account_id NOT NULL. The backfill migration and
ensure_service_account() now create a 'ResolutionFlow System' account
(display_code RF-SYS-1) before inserting the service user, satisfying the
constraint on all environments.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/core/service_account.py

@@ -18,6 +18,31 @@ logger = logging.getLogger(__name__)
 
 SERVICE_ACCOUNT_EMAIL = "noreply@resolutionflow.com"
 SERVICE_ACCOUNT_NAME = "ResolutionFlow"
+SYSTEM_ACCOUNT_NAME = "ResolutionFlow System"
+SYSTEM_ACCOUNT_DISPLAY_CODE = "RF-SYS-1"
+
+
+async def _ensure_system_account(db: AsyncSession) -> uuid.UUID:
+    """Get or create the ResolutionFlow system account. Returns its ID."""
+    from app.models.account import Account
+    from sqlalchemy import text
+
+    result = await db.execute(
+        select(Account).where(Account.display_code == SYSTEM_ACCOUNT_DISPLAY_CODE)
+    )
+    account = result.scalar_one_or_none()
+    if account is not None:
+        return account.id
+
+    new_account = Account(
+        id=uuid.uuid4(),
+        name=SYSTEM_ACCOUNT_NAME,
+        display_code=SYSTEM_ACCOUNT_DISPLAY_CODE,
+    )
+    db.add(new_account)
+    await db.flush()
+    logger.info(f"[service_account] Created system account (id={new_account.id})")
+    return new_account.id
 
 
 async def ensure_service_account(db: AsyncSession) -> uuid.UUID:
@@ -40,7 +65,8 @@ async def ensure_service_account(db: AsyncSession) -> uuid.UUID:
             await db.commit()
         return user.id
 
-    # Create the service account with a random, unusable password hash
+    account_id = await _ensure_system_account(db)
+
     new_user = User(
         id=uuid.uuid4(),
         email=SERVICE_ACCOUNT_EMAIL,
@@ -52,6 +78,7 @@ async def ensure_service_account(db: AsyncSession) -> uuid.UUID:
         is_active=True,
         is_service_account=True,
         must_change_password=False,
+        account_id=account_id,
         account_role="engineer",
     )
     db.add(new_user)