feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3

- api/auth.py login + refresh call sites pass User-Agent and Accept-Language
  headers to create_access_token (D-05 — fgp binding at token issuance)
- test_auth_fgp.py: promote all 4 xfail stubs to real assertions (FGP-01..04)
- conftest.py: add _TEST_USER_AGENT constant; configure async_client to send
  consistent User-Agent; update auth_user/second_auth_user/admin_user fixtures
  to bind fgp to _TEST_USER_AGENT so tokens validate correctly in tests
- test_auth_deps.py: import _TEST_USER_AGENT; update auth_client fixture and
  all create_access_token calls to use the constant
- test_cloud.py: update _create_user_and_token to bind fgp to _TEST_USER_AGENT
- test_documents.py: update 3 inline create_access_token calls to pass user_agent
- test_security_headers.py: import _TEST_USER_AGENT; update headers_client +
  token creation to use the constant
- Version bump: backend 0.1.2 → 0.1.3, frontend 0.1.2 → 0.1.3
- [Rule 1 - Bug] Fix httpx default User-Agent vs empty-string fgp mismatch in
  test infrastructure: 10 tests were failing due to fgp check rejecting tokens
  created with fgp="" when client sent "python-httpx/X.Y.Z"

backend/tests/test_auth_deps.py

@@ -22,6 +22,7 @@ from fastapi import FastAPI, Depends
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from tests.test_auth_api import FakeRedis
+from tests.conftest import _TEST_USER_AGENT
 
 
 # ── Minimal test app with /test/me and /test/admin routes ─────────────────────
@@ -65,7 +66,13 @@ async def auth_client(db_session: AsyncSession):
     app = make_test_app()
     app.dependency_overrides[get_db] = lambda: db_session
 
-    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as c:
+    # Phase 7.4: send _TEST_USER_AGENT so fgp check in get_current_user succeeds
+    # for tokens created with the same user-agent below.
+    async with AsyncClient(
+        transport=ASGITransport(app=app),
+        base_url="http://test",
+        headers={"User-Agent": _TEST_USER_AGENT},
+    ) as c:
         yield c
 
     app.dependency_overrides.clear()
@@ -97,7 +104,7 @@ async def test_get_current_user_returns_user(auth_client, db_session):
     from services.auth import create_access_token
 
     user = await _create_user(db_session, role="user")
-    token = create_access_token(str(user.id), "user")
+    token = create_access_token(str(user.id), "user", user_agent=_TEST_USER_AGENT)
 
     resp = await auth_client.get(
         "/test/me", headers={"Authorization": f"Bearer {token}"}
@@ -124,7 +131,7 @@ async def test_get_current_user_rejects_inactive_user(auth_client, db_session):
     from services.auth import create_access_token
 
     user = await _create_user(db_session, role="user", is_active=False)
-    token = create_access_token(str(user.id), "user")
+    token = create_access_token(str(user.id), "user", user_agent=_TEST_USER_AGENT)
 
     resp = await auth_client.get(
         "/test/me", headers={"Authorization": f"Bearer {token}"}
@@ -138,7 +145,7 @@ async def test_get_current_admin_rejects_non_admin(auth_client, db_session):
     from services.auth import create_access_token
 
     user = await _create_user(db_session, role="user")
-    token = create_access_token(str(user.id), "user")
+    token = create_access_token(str(user.id), "user", user_agent=_TEST_USER_AGENT)
 
     resp = await auth_client.get(
         "/test/admin", headers={"Authorization": f"Bearer {token}"}
@@ -153,7 +160,7 @@ async def test_get_current_admin_allows_admin(auth_client, db_session):
     from services.auth import create_access_token
 
     admin_user = await _create_user(db_session, role="admin")
-    token = create_access_token(str(admin_user.id), "admin")
+    token = create_access_token(str(admin_user.id), "admin", user_agent=_TEST_USER_AGENT)
 
     resp = await auth_client.get(
         "/test/admin", headers={"Authorization": f"Bearer {token}"}
@@ -193,7 +200,7 @@ async def test_get_current_user_rejects_token_when_iat_before_user_nbf(auth_clie
     import time
 
     user = await _create_user(db_session, role="user")
-    token = create_access_token(str(user.id), "user")
+    token = create_access_token(str(user.id), "user", user_agent=_TEST_USER_AGENT)
 
     # Pre-populate Redis with a future nbf (token's iat will be < this value)
     future_ts = int(time.time()) + 3600
@@ -215,7 +222,7 @@ async def test_get_current_user_allows_token_when_iat_after_user_nbf(auth_client
     import time
 
     user = await _create_user(db_session, role="user")
-    token = create_access_token(str(user.id), "user")
+    token = create_access_token(str(user.id), "user", user_agent=_TEST_USER_AGENT)
 
     # Pre-populate Redis with a past nbf (token's iat will be > this value)
     past_ts = int(time.time()) - 3600
@@ -238,7 +245,7 @@ async def test_get_current_user_failopen_on_redis_error(auth_client, db_session)
             raise RuntimeError("simulated redis down")
 
     user = await _create_user(db_session, role="user")
-    token = create_access_token(str(user.id), "user")
+    token = create_access_token(str(user.id), "user", user_agent=_TEST_USER_AGENT)
 
     # Override app.state.redis with a broken redis for this test
     auth_client._transport.app.state.redis = _BrokenRedis()