Fix remaining CI failures: testutil Drop cleanup, system_key_test signature

- testutil.CleanupCollections now uses Drop (not DeleteMany) — consistent with
  handlers package cleanup; prevents unique-index duplicate key errors when
  packages run concurrently against the same lightcms-test database
- Update system_key_test.go calls to EnsureSystemAPIKey with new nil adminUserID arg

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jonradoff

internal/services/system_key_test.go

@@ -14,7 +14,7 @@ func TestEnsureSystemAPIKey_CreatesNewKey(t *testing.T) {
 	apiKeySvc := NewAPIKeyService(db)
 	ctx := context.Background()
 
-	rawKey, err := EnsureSystemAPIKey(ctx, db, apiKeySvc)
+	rawKey, err := EnsureSystemAPIKey(ctx, db, apiKeySvc, nil)
 	if err != nil {
 		t.Fatalf("EnsureSystemAPIKey failed: %v", err)
 	}
@@ -38,13 +38,13 @@ func TestEnsureSystemAPIKey_ReturnsCachedKey(t *testing.T) {
 	ctx := context.Background()
 
 	// First call creates
-	key1, err := EnsureSystemAPIKey(ctx, db, apiKeySvc)
+	key1, err := EnsureSystemAPIKey(ctx, db, apiKeySvc, nil)
 	if err != nil {
 		t.Fatalf("first EnsureSystemAPIKey failed: %v", err)
 	}
 
 	// Second call returns same key
-	key2, err := EnsureSystemAPIKey(ctx, db, apiKeySvc)
+	key2, err := EnsureSystemAPIKey(ctx, db, apiKeySvc, nil)
 	if err != nil {
 		t.Fatalf("second EnsureSystemAPIKey failed: %v", err)
 	}
@@ -62,7 +62,7 @@ func TestEnsureSystemAPIKey_RecreatesDeletedKey(t *testing.T) {
 	ctx := context.Background()
 
 	// Create system key
-	key1, _ := EnsureSystemAPIKey(ctx, db, apiKeySvc)
+	key1, _ := EnsureSystemAPIKey(ctx, db, apiKeySvc, nil)
 
 	// Delete all API keys (simulating key deletion)
 	keys, _ := apiKeySvc.ListAPIKeys(ctx)
@@ -71,7 +71,7 @@ func TestEnsureSystemAPIKey_RecreatesDeletedKey(t *testing.T) {
 	}
 
 	// Should create a new key since the old one is invalid
-	key2, err := EnsureSystemAPIKey(ctx, db, apiKeySvc)
+	key2, err := EnsureSystemAPIKey(ctx, db, apiKeySvc, nil)
 	if err != nil {
 		t.Fatalf("EnsureSystemAPIKey after deletion failed: %v", err)
 	}

internal/testutil/testutil.go

@@ -15,7 +15,6 @@ import (
 
 	"lightcms/internal/database"
 
-	"go.mongodb.org/mongo-driver/bson"
 	"go.mongodb.org/mongo-driver/mongo/options"
 	"go.mongodb.org/mongo-driver/mongo/writeconcern"
 )
@@ -121,9 +120,9 @@ func MustConnectTestDB(t *testing.T) (*database.DB, func()) {
 	return sharedDB, cleanup
 }
 
-// CleanupCollections removes all documents from test collections for isolation
-// between tests. Uses DeleteMany instead of Drop so that indexes are preserved —
-// Drop + recreate requires createIndexes to do real round-trips on every test.
+// CleanupCollections drops test collections for isolation between tests.
+// Dropping ensures unique indexes (e.g. users.email) are also cleared, preventing
+// duplicate key errors when MigrateToMultiUser runs in subsequent tests.
 func CleanupCollections(t *testing.T, db *database.DB) {
 	t.Helper()
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
@@ -136,9 +135,8 @@ func CleanupCollections(t *testing.T, db *database.DB) {
 		"users", "audit_logs", "user_activity",
 		"oauth_clients", "oauth_auth_codes", "oauth_access_tokens", "oauth_refresh_tokens",
 	}
-	empty := bson.M{}
 	for _, name := range collections {
-		db.Collection(name).DeleteMany(ctx, empty)
+		db.Collection(name).Drop(ctx) //nolint:errcheck
 	}
 }