Require LDAP username on first VPN launch

tests/smoke.sh

@@ -61,6 +61,11 @@ printf '%s\n' "$keychain_status_json" | grep -q '"touchid":{"enabled":false'
 bitwarden_status_json="$(LEMANA_VPN_CREDENTIAL_SOURCE=bitwarden bash "$ROOT/bin/vpn-lemanapro.sh" --status --json)"
 printf '%s\n' "$bitwarden_status_json" | grep -q '"credentials":{"source":"bitwarden","keychain_ready":false}'
 printf '%s\n' "$bitwarden_status_json" | grep -q '"bitwarden":{"enabled":true'
+personal_ldap='601''03293'
+if grep -R "$personal_ldap" "$ROOT/bin" "$ROOT/install.sh" "$ROOT/uninstall.sh" "$ROOT/README.md" "$ROOT/templates" "$ROOT/app" "$ROOT/.agents" >/dev/null; then
+  echo "personal LDAP username must not be hardcoded in runtime, installer, app, docs, or agent guidance" >&2
+  exit 1
+fi
 grep -q 'LemanaVPN-openconnect-lite.log' "$ROOT/bin/vpn-lemanapro.sh"
 grep -q '"event":"waiting"' "$ROOT/bin/vpn-lemanapro.sh"
 grep -q -- '--patch-only' "$ROOT/bin/vpn-lemanapro.sh"
@@ -238,12 +243,43 @@ if printf '%s\n' "$manual_output" | grep -q 'Cleaning up VPN DNS'; then
   exit 1
 fi
 
+missing_username_home="$TMP_DIR/missing-username-home"
+mkdir -p "$missing_username_home"
+set +e
+missing_username_output="$(
+  HOME="$missing_username_home" \
+  LEMANA_VPN_CONFIG_DIR="$missing_username_home/.config/lemana-vpn" \
+  OPENCONNECT_LITE_CONFIG_DIR="$missing_username_home/.config/openconnect-lite" \
+  LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
+  bash "$ROOT/bin/vpn-lemanapro.sh" --json 2>&1
+)"
+missing_username_code=$?
+set -e
+
+[ "$missing_username_code" -ne 0 ]
+printf '%s\n' "$missing_username_output" | grep -q '"event":"username_required"'
+printf '%s\n' "$missing_username_output" | grep -q 'LDAP username is missing'
+if printf '%s\n' "$missing_username_output" | grep -q '"event":"keychain_required"'; then
+  echo "missing username should fail before checking Keychain credentials" >&2
+  exit 1
+fi
+
 fake_path_bin="$TMP_DIR/fake-path-bin"
 mkdir -p "$fake_path_bin"
 cat > "$fake_path_bin/security" <<'SH'
 #!/bin/sh
 if [ "${1:-}" = "find-generic-password" ]; then
-  exit 0
+  account=""
+  while [ "$#" -gt 0 ]; do
+    if [ "$1" = "-a" ]; then
+      shift
+      account="${1:-}"
+      break
+    fi
+    shift
+  done
+  [ -n "$account" ]
+  exit $?
 fi
 exit 1
 SH
@@ -262,6 +298,47 @@ exit 0
 SH
 chmod +x "$fake_oc_bin"
 
+if command -v expect >/dev/null 2>&1; then
+  first_username_home="$TMP_DIR/first-username-home"
+  mkdir -p "$first_username_home/.config/lemana-vpn" "$first_username_home/.config/openconnect-lite"
+  printf 'LEMANA_VPN_CREDENTIAL_SOURCE="keychain"\nLEMANA_VPN_USE_BITWARDEN="0"\nLEMANA_VPN_USE_TOUCHID="0"\n' > "$first_username_home/.config/lemana-vpn/env"
+  printf 'username = ""\n' > "$first_username_home/.config/openconnect-lite/config.toml"
+
+  FIRST_USERNAME_HOME="$first_username_home" \
+  ROOT="$ROOT" \
+  FAKE_PATH_BIN="$fake_path_bin" \
+  FAKE_OC_BIN="$fake_oc_bin" \
+  FAKE_WEBENGINE="$fake_webengine" \
+  FAKE_AUTHENTICATOR="$fake_authenticator" \
+  MANUAL_FULL_CAPTURE="$manual_full_capture" \
+  TMP_DIR="$TMP_DIR" \
+    expect <<'EXPECT'
+set timeout 30
+log_user 0
+set home $env(FIRST_USERNAME_HOME)
+spawn env \
+  HOME=$home \
+  PATH=$env(FAKE_PATH_BIN):$env(PATH) \
+  LEMANA_VPN_CONFIG_DIR=$home/.config/lemana-vpn \
+  OPENCONNECT_LITE_CONFIG_DIR=$home/.config/openconnect-lite \
+  LEMANA_VPN_OC_BIN=$env(FAKE_OC_BIN) \
+  LEMANA_VPN_OC_PYTHON=python3 \
+  LEMANA_VPN_WEBENGINE_PROCESS=$env(FAKE_WEBENGINE) \
+  LEMANA_VPN_AUTHENTICATOR=$env(FAKE_AUTHENTICATOR) \
+  LEMANA_VPN_PATCH_BACKUP_DIR=$env(TMP_DIR)/first-username-patch-backups \
+  LEMANA_VPN_DNS_CLEANUP=$env(TMP_DIR)/no-dns-cleanup \
+  LEMANA_VPN_CONNECT_LOG=$env(TMP_DIR)/first-username.log \
+  LEMANA_VPN_CAPTURE_LAUNCH=$env(MANUAL_FULL_CAPTURE) \
+  bash $env(ROOT)/bin/vpn-lemanapro.sh --manual-full --json
+expect "Corporate LDAP username:"
+send "lemana-first-user\r"
+expect eof
+EXPECT
+
+  grep -q 'LEMANA_VPN_USERNAME="lemana-first-user"' "$first_username_home/.config/lemana-vpn/env"
+  grep -q 'username = "lemana-first-user"' "$first_username_home/.config/openconnect-lite/config.toml"
+fi
+
 manual_full_output="$(
   HOME="$HOME" \
   PATH="$fake_path_bin:$PATH" \