feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3

- api/auth.py login + refresh call sites pass User-Agent and Accept-Language
  headers to create_access_token (D-05 — fgp binding at token issuance)
- test_auth_fgp.py: promote all 4 xfail stubs to real assertions (FGP-01..04)
- conftest.py: add _TEST_USER_AGENT constant; configure async_client to send
  consistent User-Agent; update auth_user/second_auth_user/admin_user fixtures
  to bind fgp to _TEST_USER_AGENT so tokens validate correctly in tests
- test_auth_deps.py: import _TEST_USER_AGENT; update auth_client fixture and
  all create_access_token calls to use the constant
- test_cloud.py: update _create_user_and_token to bind fgp to _TEST_USER_AGENT
- test_documents.py: update 3 inline create_access_token calls to pass user_agent
- test_security_headers.py: import _TEST_USER_AGENT; update headers_client +
  token creation to use the constant
- Version bump: backend 0.1.2 → 0.1.3, frontend 0.1.2 → 0.1.3
- [Rule 1 - Bug] Fix httpx default User-Agent vs empty-string fgp mismatch in
  test infrastructure: 10 tests were failing due to fgp check rejecting tokens
  created with fgp="" when client sent "python-httpx/X.Y.Z"

backend/tests/test_cloud.py

@@ -22,6 +22,8 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 pytestmark = pytest.mark.asyncio
 
+from tests.conftest import _TEST_USER_AGENT
+
 
 # ── Shared auth helper ────────────────────────────────────────────────────────
 
@@ -29,6 +31,8 @@ async def _create_user_and_token(session, role: str = "user"):
     """Create a User + Quota row, return {user, token, headers}.
 
     Mirrors the auth_user fixture pattern from conftest.py.
+    Phase 7.4: tokens are bound to _TEST_USER_AGENT fgp so async_client
+    (which sends the same User-Agent) passes fgp validation in get_current_user.
     """
     from db.models import User, Quota
     from services.auth import hash_password, create_access_token
@@ -52,7 +56,8 @@ async def _create_user_and_token(session, role: str = "user"):
     session.add(quota)
     await session.commit()
 
-    token = create_access_token(str(user_id), role)
+    # Phase 7.4: bind fgp to _TEST_USER_AGENT (matches async_client default)
+    token = create_access_token(str(user_id), role, user_agent=_TEST_USER_AGENT)
     return {
         "user": user,
         "token": token,