style(auth): apply code quality suggestions from review

- auth.py: replace 'import os as _os' with plain 'import os' inside
  authenticate_pam() — the alias convention is for module-level private
  names, not function-scoped imports
- test_auth.py: move 'import pwd' from two test functions to module-level
  imports, consistent with existing 'import os' placement
- test_auth.py: make wrong-user test robust against running as root —
  derives 'wrong_user' dynamically so the test holds in Docker CI
  environments where the runner may be root

muxplex/auth.py

@@ -114,12 +114,12 @@ def pam_available() -> bool:
 
 def authenticate_pam(username: str, password: str) -> bool:
     """Authenticate via PAM. Username must match the running process owner."""
-    import os as _os
+    import os
     import pwd
 
     import pam
 
-    running_user = pwd.getpwuid(_os.getuid()).pw_name
+    running_user = pwd.getpwuid(os.getuid()).pw_name
     if username != running_user:
         return False
     return pam.authenticate(username, password, service="login")

muxplex/tests/test_auth.py

@@ -1,6 +1,7 @@
 """Tests for muxplex/auth.py — authentication module."""
 
 import os
+import pwd
 import stat
 from pathlib import Path
 
@@ -205,8 +206,6 @@ def test_pam_available_returns_false_on_import_error(monkeypatch):
 
 def test_authenticate_pam_success(monkeypatch):
     """authenticate_pam() returns True when PAM succeeds for the running user."""
-    import pwd
-
     from muxplex.auth import authenticate_pam
 
     running_user = pwd.getpwuid(os.getuid()).pw_name
@@ -216,8 +215,6 @@ def test_authenticate_pam_success(monkeypatch):
 
 def test_authenticate_pam_wrong_password(monkeypatch):
     """authenticate_pam() returns False when PAM rejects credentials."""
-    import pwd
-
     from muxplex.auth import authenticate_pam
 
     running_user = pwd.getpwuid(os.getuid()).pw_name
@@ -229,6 +226,10 @@ def test_authenticate_pam_wrong_user_rejected(monkeypatch):
     """authenticate_pam() rejects a different username even if PAM would accept it."""
     from muxplex.auth import authenticate_pam
 
+    # Pick a wrong user that is guaranteed to differ from whoever is running the tests
+    running_user = pwd.getpwuid(os.getuid()).pw_name
+    wrong_user = "nobody" if running_user == "root" else "root"
+
     # Mock PAM to always return True — but wrong username should still fail
     monkeypatch.setattr("pam.authenticate", lambda u, p, service="login": True)
-    assert authenticate_pam("root", "any-password") is False
+    assert authenticate_pam(wrong_user, "any-password") is False