Start without git, and say what that costs

A `pip install` on a locked-down host — the case the CLI exists for —
may have no git, and the store shelled out to it while building the flow
repository, so the engine refused to start at all. The store is files;
git is their history. Missing it is now one warning and no commits
rather than a stack trace, which is the difference between a machine
that runs your experiments and one that does not.

Found by installing the wheels into a bare python:3.12-slim and pairing
it with the portal: `fluksio enroll` took the code, `fluksio serve`
dialled out, and the hub was proxying requests through the tunnel.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/fluksio/cli.py

@@ -124,14 +124,17 @@ def _enroll(portal: str, code: str, as_email: str | None) -> int:
     from fluksio.core.db import engine
 
     with Session(engine) as session:
-        _, generated = ensure_superuser(session, email=as_email)
+        admin, generated = ensure_superuser(session, email=as_email)
         if generated:
-            _print_new_admin(session, generated)
+            _print_new_admin(admin.email, generated)
         try:
             user = pick_superuser(session, as_email)
         except LookupError as exc:
             print(f"error: {exc}", file=sys.stderr, flush=True)
             return 1
+        # Read before the session closes: the instance is detached after it,
+        # and touching an attribute then goes back to a database that is gone.
+        email = user.email
         try:
             config = enroll_mod.enroll(session, user, portal, code)
         except enroll_mod.AlreadyEnrolled as exc:
@@ -146,22 +149,14 @@ def _enroll(portal: str, code: str, as_email: str | None) -> int:
             return 1
 
     _say(
-        f"Connected to {config.portal_url} as {user.email} "
+        f"Connected to {config.portal_url} as {email} "
         f"(installation {config.installation_id})."
     )
     return 0
 
 
-def _print_new_admin(session: object, password: str) -> None:
-    from sqlmodel import Session, select
-
-    from fluksio.models import User
-
-    assert isinstance(session, Session)
-    user = session.exec(
-        select(User).where(User.is_superuser == True)  # noqa: E712
-    ).first()
-    _say(f"Created the admin account {user.email if user else ''}")
+def _print_new_admin(email: str, password: str) -> None:
+    _say(f"Created the admin account {email}")
     _say(f"  password: {password}")
     _say("  Shown once. Change it from the dashboard.")
 
@@ -177,11 +172,11 @@ def cmd_serve(args: argparse.Namespace) -> int:
     from fluksio.core.db import engine
 
     with Session(engine) as session:
-        _, generated = ensure_superuser(
+        admin, generated = ensure_superuser(
             session, email=args.admin_email, password=args.admin_password
         )
         if generated:
-            _print_new_admin(session, generated)
+            _print_new_admin(admin.email, generated)
 
     if args.enroll:
         if not args.portal: