feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3

- api/auth.py login + refresh call sites pass User-Agent and Accept-Language
  headers to create_access_token (D-05 — fgp binding at token issuance)
- test_auth_fgp.py: promote all 4 xfail stubs to real assertions (FGP-01..04)
- conftest.py: add _TEST_USER_AGENT constant; configure async_client to send
  consistent User-Agent; update auth_user/second_auth_user/admin_user fixtures
  to bind fgp to _TEST_USER_AGENT so tokens validate correctly in tests
- test_auth_deps.py: import _TEST_USER_AGENT; update auth_client fixture and
  all create_access_token calls to use the constant
- test_cloud.py: update _create_user_and_token to bind fgp to _TEST_USER_AGENT
- test_documents.py: update 3 inline create_access_token calls to pass user_agent
- test_security_headers.py: import _TEST_USER_AGENT; update headers_client +
  token creation to use the constant
- Version bump: backend 0.1.2 → 0.1.3, frontend 0.1.2 → 0.1.3
- [Rule 1 - Bug] Fix httpx default User-Agent vs empty-string fgp mismatch in
  test infrastructure: 10 tests were failing due to fgp check rejecting tokens
  created with fgp="" when client sent "python-httpx/X.Y.Z"

backend/api/auth.py

@@ -287,7 +287,12 @@ async def login(
             )
 
     # Issue tokens
-    access_token = auth_service.create_access_token(str(user.id), user.role)
+    access_token = auth_service.create_access_token(
+        str(user.id),
+        user.role,
+        user_agent=request.headers.get("User-Agent", ""),
+        accept_lang=request.headers.get("Accept-Language", ""),
+    )
     raw_refresh = await auth_service.create_refresh_token(session, user.id, remember_me=body.remember_me)
     _set_refresh_cookie(response, raw_refresh, remember_me=body.remember_me)
 
@@ -361,7 +366,12 @@ async def refresh_token(
     # Set new refresh cookie
     _set_refresh_cookie(response, new_raw)
 
-    access_token = auth_service.create_access_token(user_id_str, user.role)
+    access_token = auth_service.create_access_token(
+        user_id_str,
+        user.role,
+        user_agent=request.headers.get("User-Agent", ""),
+        accept_lang=request.headers.get("Accept-Language", ""),
+    )
     return {
         "access_token": access_token,
         "user": {