cli: avoid data-dir initialization for version; create db parent dirs; redact generated passwords in CLI output

- Prevent 'nx9-wg version' from creating data directories by avoiding database initialization.
- Create parent directories when an explicit --database path is provided.
- Redact printed generated administrator passwords; announce file path or redact instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

crates/nx9-wg-api/tests/test_ui_endpoints.rs

@@ -0,0 +1,94 @@
+//! Integration tests for embedded Web UI SPA and static asset endpoints.
+
+use axum::body::to_bytes;
+use axum::http::{Request, StatusCode};
+use nx9_wg_api::routes::build_api_router;
+use nx9_wg_api::state::AppState;
+use nx9_wg_db::Store;
+use tower::ServiceExt;
+
+#[tokio::test]
+async fn test_ui_spa_index_and_stylesheet_endpoints() {
+    let store = Store::connect_in_memory().await.expect("connect store");
+    store.migrate().await.expect("migrate store");
+    let state = AppState::new(store);
+    let app = build_api_router(state);
+
+    // 1. Test GET / (Root SPA Index)
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri("/")
+                .body(axum::body::Body::empty())
+                .unwrap(),
+        )
+        .await
+        .expect("execute request");
+
+    assert_eq!(res.status(), StatusCode::OK);
+    assert_eq!(
+        res.headers()
+            .get(axum::http::header::CONTENT_TYPE)
+            .unwrap()
+            .to_str()
+            .unwrap(),
+        "text/html; charset=utf-8"
+    );
+
+    let body_bytes = to_bytes(res.into_body(), 1024 * 1024).await.unwrap();
+    let html = String::from_utf8_lossy(&body_bytes);
+    assert!(html.contains("nx9-wg — Native WireGuard Appliance"));
+    assert!(html.contains("NX9"));
+    assert!(html.contains("id=\"app-layout\""));
+    assert!(html.contains("id=\"sidebar\""));
+    assert!(html.contains("Dashboard"));
+    assert!(html.contains("Peers"));
+    assert!(html.contains("Diagnostics"));
+    assert!(html.contains("Administrator"));
+
+    // 2. Test GET /ui (Alias)
+    let res_ui = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri("/ui")
+                .body(axum::body::Body::empty())
+                .unwrap(),
+        )
+        .await
+        .expect("execute request");
+
+    assert_eq!(res_ui.status(), StatusCode::OK);
+
+    // 3. Test GET /assets/style.css (Compiled CSS)
+    let res_css = app
+        .oneshot(
+            Request::builder()
+                .uri("/assets/style.css")
+                .body(axum::body::Body::empty())
+                .unwrap(),
+        )
+        .await
+        .expect("execute request");
+
+    assert_eq!(res_css.status(), StatusCode::OK);
+    assert_eq!(
+        res_css
+            .headers()
+            .get(axum::http::header::CONTENT_TYPE)
+            .unwrap()
+            .to_str()
+            .unwrap(),
+        "text/css; charset=utf-8"
+    );
+
+    let css_bytes = to_bytes(res_css.into_body(), 1024 * 1024).await.unwrap();
+    let css = String::from_utf8_lossy(&css_bytes);
+    assert!(css.contains("--bg-base: #0d1117;"));
+    assert!(css.contains("[data-theme=\"dark\"]"));
+    assert!(css.contains("[data-theme=\"light\"]"));
+    assert!(css.contains(".status-pass"));
+    assert!(css.contains(".status-fail"));
+    assert!(css.contains("@media (max-width: 768px)"));
+}