feat(admin/users): implement create_verified_user

Replaces the dummy stub with a real implementation that:
- calls save_user(cursor, email, name, verified=True) to create the user
  with the verified flag set, bypassing the email verification flow
- calls set_user_password to store the hashed credential in user_credentials
- returns the newly created User with no roles assigned

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

2 files changed, 24 insertions, 5 deletions

diff --git a/gn_auth/auth/authorisation/users/admin/models.py b/gn_auth/auth/authorisation/users/admin/models.py
index 71c4ffc..65db8cc 100644
--- a/gn_auth/auth/authorisation/users/admin/models.py
+++ b/gn_auth/auth/authorisation/users/admin/models.py
@@ -2,9 +2,10 @@
 import warnings
 
 from gn_auth.auth.db import sqlite3 as db
-from gn_auth.auth.authentication.users import User, DUMMY_USER
+from gn_auth.auth.authentication.users import User
 from gn_auth.auth.authorisation.roles.models import Role, db_rows_to_roles
 from gn_auth.auth.authorisation.resources.system.models import system_resource
+from gn_auth.auth.authorisation.users.models import create_credentialed_user
 
 
 def sysadmin_role(conn: db.DbConnection) -> Role:
@@ -62,6 +63,5 @@ def create_verified_user(
         name: str,
         password: str
 ) -> User:
-    """Create a verified user."""
-    _vars = (conn, email, name, password)
-    return DUMMY_USER
+    """Create a pre-verified credentialed user with no roles."""
+    return create_credentialed_user(conn, email, name, password, verified=True)
diff --git a/gn_auth/auth/authorisation/users/models.py b/gn_auth/auth/authorisation/users/models.py
index ab7a980..21a9627 100644
--- a/gn_auth/auth/authorisation/users/models.py
+++ b/gn_auth/auth/authorisation/users/models.py
@@ -9,7 +9,7 @@ from ..checks import authorised_p
 from ..privileges import Privilege
 
 from ...db import sqlite3 as db
-from ...authentication.users import User
+from ...authentication.users import User, save_user, set_user_password
 
 
 def __process_age_clause__(age_desc: str) -> tuple[str, int]:
@@ -166,3 +166,22 @@ def delete_users_by_id(
         cursor.execute(
             f"DELETE FROM users WHERE user_id IN ({_paramstr})", _ids)
         return cursor.rowcount
+
+
+def create_credentialed_user(
+        conn: db.DbConnection,
+        email: str,
+        name: str,
+        password: str,
+        *,
+        verified: bool = False
+) -> User:
+    """Create a user with stored password credentials.
+
+    Caller controls the verified flag — pass verified=True to bypass the
+    normal email-verification flow (e.g. admin provisioning).
+    """
+    with db.cursor(conn) as cursor:
+        user = save_user(cursor, email, name, verified=verified)
+        set_user_password(cursor, user, password)
+    return user