Add admin user email management

backend/tests/test_backend_quality.py

@@ -1320,6 +1320,39 @@ class DatabaseEmailTests(TempDatabaseMixin, unittest.TestCase):
         self.assertEqual(stored.get("email"), "mixed@example.com")
 
 
+class AdminUserEmailTests(TempDatabaseMixin, unittest.IsolatedAsyncioTestCase):
+    async def test_admin_can_add_and_remove_user_email(self) -> None:
+        db.create_user_if_missing("Viewer", "password123", auth_provider="local")
+
+        saved = await admin_router.update_user_email("viewer", {"email": "viewer@example.com"})
+        self.assertEqual(saved["user"]["email"], "viewer@example.com")
+
+        cleared = await admin_router.update_user_email("VIEWER", {"email": None})
+        self.assertIsNone(cleared["user"]["email"])
+
+    async def test_admin_cannot_assign_duplicate_user_email(self) -> None:
+        db.create_user_if_missing(
+            "FirstViewer", "password123", email="shared@example.com", auth_provider="local"
+        )
+        db.create_user_if_missing("SecondViewer", "password123", auth_provider="local")
+
+        with self.assertRaises(HTTPException) as context:
+            await admin_router.update_user_email(
+                "SecondViewer", {"email": "SHARED@example.com"}
+            )
+
+        self.assertEqual(context.exception.status_code, 409)
+        self.assertIn("another user", str(context.exception.detail))
+
+    async def test_admin_user_email_requires_valid_address(self) -> None:
+        db.create_user_if_missing("Viewer", "password123", auth_provider="local")
+
+        with self.assertRaises(HTTPException) as context:
+            await admin_router.update_user_email("Viewer", {"email": "not-an-email"})
+
+        self.assertEqual(context.exception.status_code, 400)
+
+
 class SnapshotHistoryTests(TempDatabaseMixin, unittest.TestCase):
     def test_duplicate_snapshots_are_not_saved_and_download_evidence_is_retained(self) -> None:
         snapshot = Snapshot(