fix: users loop clobbered requesting username in settings filtering

The users-section loop reused 'username' as its loop variable, overwriting
the requesting user's name so host/threshold filtering compared against the
last user in the config. Rename to 'uname' and add a regression test with a
user that is not last in the users dict.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NfPpSpccTWBfZg1FTveyaU

hbd/server/settings.py

@@ -238,11 +238,11 @@ def get_settings_sections(config: dict, threshold_checker=None, user=None) -> li
 
     # ---- Users (show metadata only, never password hashes) ----------------
     users_list = []
-    for username, attrs in (config.get("users") or {}).items():
+    for uname, attrs in (config.get("users") or {}).items():
         if not isinstance(attrs, dict):
             continue
         users_list.append({
-            "username": username,
+            "username": uname,
             "full_name": attrs.get("full_name", ""),
             "admin": bool(attrs.get("admin", False)),
             "avatar": attrs.get("avatar", ""),

tests/test_settings_sections.py

@@ -191,3 +191,16 @@ def test_settings_data_pickers_filtered_for_nonadmin():
 def test_no_user_means_admin_view():
     sections = settings_mod.get_settings_sections(MULTI_CFG)  # auth disabled
     assert len(sections) > 3
+
+
+def test_filtering_unaffected_by_other_users_in_config():
+    """The users-section loop must not clobber the requesting username (regression)."""
+    cfg = dict(MULTI_CFG)
+    cfg["users"] = {
+        "alice": {"full_name": "Alice", "admin": True, "password": "x"},
+        "bob": {"full_name": "Bob", "admin": False, "password": "x"},
+        "zed": {"full_name": "Zed", "admin": False, "password": "x"},  # bob is not last
+    }
+    sections = settings_mod.get_settings_sections(cfg, user=BOB)
+    hosts = {h["name"] for h in next(s for s in sections if s["id"] == "hosts")["hosts"]}
+    assert hosts == {"bobhost", "managedhost"}