feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3

- api/auth.py login + refresh call sites pass User-Agent and Accept-Language
  headers to create_access_token (D-05 — fgp binding at token issuance)
- test_auth_fgp.py: promote all 4 xfail stubs to real assertions (FGP-01..04)
- conftest.py: add _TEST_USER_AGENT constant; configure async_client to send
  consistent User-Agent; update auth_user/second_auth_user/admin_user fixtures
  to bind fgp to _TEST_USER_AGENT so tokens validate correctly in tests
- test_auth_deps.py: import _TEST_USER_AGENT; update auth_client fixture and
  all create_access_token calls to use the constant
- test_cloud.py: update _create_user_and_token to bind fgp to _TEST_USER_AGENT
- test_documents.py: update 3 inline create_access_token calls to pass user_agent
- test_security_headers.py: import _TEST_USER_AGENT; update headers_client +
  token creation to use the constant
- Version bump: backend 0.1.2 → 0.1.3, frontend 0.1.2 → 0.1.3
- [Rule 1 - Bug] Fix httpx default User-Agent vs empty-string fgp mismatch in
  test infrastructure: 10 tests were failing due to fgp check rejecting tokens
  created with fgp="" when client sent "python-httpx/X.Y.Z"

backend/tests/test_documents.py

@@ -300,6 +300,7 @@ async def test_cross_user_access_404(async_client, auth_user, db_session):
     import uuid as _uuid
     from db.models import Document, User, Quota
     from services.auth import hash_password, create_access_token
+    from tests.conftest import _TEST_USER_AGENT
 
     # Create User A's document directly via ORM
     doc_id = _uuid.uuid4()
@@ -331,7 +332,8 @@ async def test_cross_user_access_404(async_client, auth_user, db_session):
     db_session.add(quota_b)
     await db_session.commit()
 
-    token_b = create_access_token(str(user_b_id), "user")
+    # Phase 7.4: bind fgp to _TEST_USER_AGENT (matches async_client default)
+    token_b = create_access_token(str(user_b_id), "user", user_agent=_TEST_USER_AGENT)
     headers_b = {"Authorization": f"Bearer {token_b}"}
 
     # User B attempts to access User A's document — must get 404 (not 403)
@@ -521,6 +523,7 @@ async def test_content_stream_share_recipient_200(async_client, auth_user, admin
     import uuid as _uuid2
     from db.models import User, Quota
     from services.auth import hash_password, create_access_token
+    from tests.conftest import _TEST_USER_AGENT
 
     recipient_id = _uuid2.uuid4()
     recipient = User(
@@ -560,7 +563,8 @@ async def test_content_stream_share_recipient_200(async_client, auth_user, admin
     db_session.add(share)
     await db_session.commit()
 
-    recipient_token = create_access_token(str(recipient_id), "user")
+    # Phase 7.4: bind fgp to _TEST_USER_AGENT (matches async_client default)
+    recipient_token = create_access_token(str(recipient_id), "user", user_agent=_TEST_USER_AGENT)
     recipient_headers = {"Authorization": f"Bearer {recipient_token}"}
 
     resp = await async_client.get(
@@ -1015,6 +1019,7 @@ async def test_reclassify_cross_user_returns_404(async_client, auth_user, db_ses
     import uuid as _uuid
     from db.models import Document, User, Quota
     from services.auth import hash_password, create_access_token
+    from tests.conftest import _TEST_USER_AGENT
 
     # Create a document owned by auth_user
     doc_id = _uuid.uuid4()
@@ -1046,7 +1051,8 @@ async def test_reclassify_cross_user_returns_404(async_client, auth_user, db_ses
     db_session.add(quota_b)
     await db_session.commit()
 
-    token_b = create_access_token(str(user_b_id), "user")
+    # Phase 7.4: bind fgp to _TEST_USER_AGENT (matches async_client default)
+    token_b = create_access_token(str(user_b_id), "user", user_agent=_TEST_USER_AGENT)
     headers_b = {"Authorization": f"Bearer {token_b}"}
 
     # User B attempts to reclassify User A's document — must get 404