feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3

- api/auth.py login + refresh call sites pass User-Agent and Accept-Language
  headers to create_access_token (D-05 — fgp binding at token issuance)
- test_auth_fgp.py: promote all 4 xfail stubs to real assertions (FGP-01..04)
- conftest.py: add _TEST_USER_AGENT constant; configure async_client to send
  consistent User-Agent; update auth_user/second_auth_user/admin_user fixtures
  to bind fgp to _TEST_USER_AGENT so tokens validate correctly in tests
- test_auth_deps.py: import _TEST_USER_AGENT; update auth_client fixture and
  all create_access_token calls to use the constant
- test_cloud.py: update _create_user_and_token to bind fgp to _TEST_USER_AGENT
- test_documents.py: update 3 inline create_access_token calls to pass user_agent
- test_security_headers.py: import _TEST_USER_AGENT; update headers_client +
  token creation to use the constant
- Version bump: backend 0.1.2 → 0.1.3, frontend 0.1.2 → 0.1.3
- [Rule 1 - Bug] Fix httpx default User-Agent vs empty-string fgp mismatch in
  test infrastructure: 10 tests were failing due to fgp check rejecting tokens
  created with fgp="" when client sent "python-httpx/X.Y.Z"

backend/tests/test_auth_fgp.py

@@ -1,5 +1,5 @@
 """
-TDD scaffold for Phase 7.4: Token fingerprinting / token binding.
+Integration tests for Phase 7.4: Token fingerprinting / token binding.
 
 Covers FGP-01..FGP-04:
   - FGP-01 test_fgp_match_returns_200: token issued with matching UA/lang →
@@ -12,18 +12,20 @@ Covers FGP-01..FGP-04:
   - FGP-04 test_missing_headers_empty_string_binding: token issued with no
     UA/lang (defaults to ""), request sent with no User-Agent / Accept-Language
     headers → 200 (empty-string fingerprint matches).
-
-All four tests are xfail(strict=False) until Wave 1 (Plan 07.4-02) implements
-the fgp claim in services/auth.py and deps/auth.py.
 """
+import base64
 import uuid
+import uuid as _uuid
+from datetime import datetime, timezone, timedelta
 
+import jwt as _jwt
 import pytest
 import pytest_asyncio
 from httpx import ASGITransport, AsyncClient
 from fastapi import FastAPI, Depends
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from config import settings
 from tests.test_auth_api import FakeRedis
 
 
@@ -84,32 +86,107 @@ async def _create_user(db_session, role: str = "user", is_active: bool = True):
     return user
 
 
-# ── FGP stubs (Wave 0) ────────────────────────────────────────────────────────
+# ── FGP tests (Wave 1 — promoted from xfail stubs) ───────────────────────────
 
 
-@pytest.mark.xfail(strict=False, reason="not implemented yet")
 @pytest.mark.asyncio
 async def test_fgp_match_returns_200(auth_client, db_session):
     """FGP-01: token issued with matching UA/Accept-Language → 200."""
-    pytest.xfail("not implemented yet")
+    from services.auth import create_access_token
+
+    user = await _create_user(db_session, role="user")
+    token = create_access_token(
+        str(user.id),
+        "user",
+        user_agent="Mozilla/5.0",
+        accept_lang="en",
+    )
+
+    resp = await auth_client.get(
+        "/test/me",
+        headers={
+            "Authorization": f"Bearer {token}",
+            "User-Agent": "Mozilla/5.0",
+            "Accept-Language": "en",
+        },
+    )
+    assert resp.status_code == 200
 
 
-@pytest.mark.xfail(strict=False, reason="not implemented yet")
 @pytest.mark.asyncio
 async def test_fgp_mismatch_returns_401(auth_client, db_session):
     """FGP-02: token issued for one UA, request from different UA → 401."""
-    pytest.xfail("not implemented yet")
+    from services.auth import create_access_token
+
+    user = await _create_user(db_session, role="user")
+    token = create_access_token(
+        str(user.id),
+        "user",
+        user_agent="Mozilla/5.0",
+        accept_lang="en",
+    )
+
+    resp = await auth_client.get(
+        "/test/me",
+        headers={
+            "Authorization": f"Bearer {token}",
+            "User-Agent": "different-agent",
+            "Accept-Language": "en",
+        },
+    )
+    assert resp.status_code == 401
+    assert resp.json()["detail"] == "Token fingerprint mismatch"
 
 
-@pytest.mark.xfail(strict=False, reason="not implemented yet")
 @pytest.mark.asyncio
 async def test_no_fgp_claim_allowed(auth_client, db_session):
     """FGP-03: token without fgp claim → 200 (migration grace period)."""
-    pytest.xfail("not implemented yet")
+    user = await _create_user(db_session, role="user")
+
+    # Manually craft a JWT without the "fgp" key (simulating a pre-7.4 token)
+    now = datetime.now(timezone.utc)
+    payload_no_fgp = {
+        "sub": str(user.id),
+        "role": "user",
+        "typ": "access",
+        "iat": now,
+        "exp": now + timedelta(minutes=15),
+        "jti": str(_uuid.uuid4()),
+        # "fgp" intentionally absent
+    }
+    private_pem = base64.b64decode(settings.jwt_private_key).decode()
+    token = _jwt.encode(payload_no_fgp, private_pem, algorithm="ES256")
+
+    resp = await auth_client.get(
+        "/test/me",
+        headers={"Authorization": f"Bearer {token}"},
+    )
+    assert resp.status_code == 200
 
 
-@pytest.mark.xfail(strict=False, reason="not implemented yet")
 @pytest.mark.asyncio
 async def test_missing_headers_empty_string_binding(auth_client, db_session):
-    """FGP-04: token issued with no headers (empty-string binding), request with no headers → 200."""
-    pytest.xfail("not implemented yet")
+    """FGP-04: token issued with empty-string binding, request with empty UA → 200.
+
+    When no User-Agent or Accept-Language are provided, both the token issuance
+    and the validation path use empty strings. httpx sends a default User-Agent
+    header automatically, so we must explicitly set it to "" to reproduce the
+    absent-header scenario in the test client.
+    """
+    from services.auth import create_access_token
+
+    user = await _create_user(db_session, role="user")
+    # Issue token with empty-string defaults (no UA, no Accept-Language)
+    token = create_access_token(str(user.id), "user")
+
+    # Send request with empty User-Agent and no Accept-Language;
+    # FastAPI will see request.headers.get("User-Agent", "") == ""
+    # matching the empty-string fingerprint embedded in the token.
+    resp = await auth_client.get(
+        "/test/me",
+        headers={
+            "Authorization": f"Bearer {token}",
+            "User-Agent": "",
+        },
+    )
+    assert resp.status_code == 200