feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3

- api/auth.py login + refresh call sites pass User-Agent and Accept-Language
  headers to create_access_token (D-05 — fgp binding at token issuance)
- test_auth_fgp.py: promote all 4 xfail stubs to real assertions (FGP-01..04)
- conftest.py: add _TEST_USER_AGENT constant; configure async_client to send
  consistent User-Agent; update auth_user/second_auth_user/admin_user fixtures
  to bind fgp to _TEST_USER_AGENT so tokens validate correctly in tests
- test_auth_deps.py: import _TEST_USER_AGENT; update auth_client fixture and
  all create_access_token calls to use the constant
- test_cloud.py: update _create_user_and_token to bind fgp to _TEST_USER_AGENT
- test_documents.py: update 3 inline create_access_token calls to pass user_agent
- test_security_headers.py: import _TEST_USER_AGENT; update headers_client +
  token creation to use the constant
- Version bump: backend 0.1.2 → 0.1.3, frontend 0.1.2 → 0.1.3
- [Rule 1 - Bug] Fix httpx default User-Agent vs empty-string fgp mismatch in
  test infrastructure: 10 tests were failing due to fgp check rejecting tokens
  created with fgp="" when client sent "python-httpx/X.Y.Z"

backend/tests/conftest.py

@@ -30,6 +30,13 @@ from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_asyn
 from sqlalchemy.pool import StaticPool
 
 
+# ── Phase 7.4: test-client user-agent constant ────────────────────────────────
+# Tokens issued by test fixtures must embed a fgp claim matching the User-Agent
+# the test client will send. httpx.AsyncClient defaults to "python-httpx/X.Y.Z"
+# which varies by library version. We lock both token creation and the client
+# to this constant so the fgp check in get_current_user always passes in tests.
+_TEST_USER_AGENT = "docuvault-test/1.0"
+
 # ── Service availability ──────────────────────────────────────────────────────
 
 def _port_open(host: str, port: int, timeout: float = 1.0) -> bool:
@@ -146,13 +153,23 @@ async def db_session():
 
 @pytest_asyncio.fixture
 async def async_client(db_session: AsyncSession):
-    """Async HTTP test client with the DB dependency overridden to use in-memory SQLite."""
+    """Async HTTP test client with the DB dependency overridden to use in-memory SQLite.
+
+    Phase 7.4: sets a fixed User-Agent (_TEST_USER_AGENT) so that the fgp claim
+    embedded in tokens from auth_user/admin_user fixtures matches what the client
+    sends. Without this, httpx's default 'python-httpx/X.Y.Z' UA would differ
+    from the empty-string UA used when creating tokens without explicit headers.
+    """
     from deps.db import get_db
     from main import app
 
     app.dependency_overrides[get_db] = lambda: db_session
 
-    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as c:
+    async with AsyncClient(
+        transport=ASGITransport(app=app),
+        base_url="http://test",
+        headers={"User-Agent": _TEST_USER_AGENT},
+    ) as c:
         yield c
 
     app.dependency_overrides.clear()
@@ -273,7 +290,10 @@ async def auth_user(db_session: AsyncSession):
     db_session.add(quota)
     await db_session.commit()
 
-    token = create_access_token(str(user_id), "user")
+    # Phase 7.4: bind token fgp to _TEST_USER_AGENT so get_current_user validates
+    # successfully when the token is used via the async_client fixture (which sends
+    # the same User-Agent constant).
+    token = create_access_token(str(user_id), "user", user_agent=_TEST_USER_AGENT)
     return {
         "user": user,
         "token": token,
@@ -312,7 +332,8 @@ async def second_auth_user(db_session: AsyncSession):
     db_session.add(quota)
     await db_session.commit()
 
-    token = create_access_token(str(user_id), "user")
+    # Phase 7.4: bind token fgp to _TEST_USER_AGENT (matches async_client default)
+    token = create_access_token(str(user_id), "user", user_agent=_TEST_USER_AGENT)
     return {
         "user": user,
         "token": token,
@@ -349,7 +370,8 @@ async def admin_user(db_session: AsyncSession):
     db_session.add(quota)
     await db_session.commit()
 
-    token = create_access_token(str(user_id), "admin")
+    # Phase 7.4: bind token fgp to _TEST_USER_AGENT (matches async_client default)
+    token = create_access_token(str(user_id), "admin", user_agent=_TEST_USER_AGENT)
     return {
         "user": user,
         "token": token,