test(07.4-01): add Wave 0 xfail stubs for FGP-01..FGP-04

- Create backend/tests/test_auth_fgp.py with 4 xfail(strict=False) stubs
- FGP-01: test_fgp_match_returns_200 (matching headers → 200)
- FGP-02: test_fgp_mismatch_returns_401 (wrong UA → 401)
- FGP-03: test_no_fgp_claim_allowed (no fgp claim → 200 migration grace)
- FGP-04: test_missing_headers_empty_string_binding (empty-string binding → 200)
- All 4 tests report XFAIL; full suite remains at 1 pre-existing failure only

backend/tests/test_auth_fgp.py

@@ -0,0 +1,115 @@
+"""
+TDD scaffold for Phase 7.4: Token fingerprinting / token binding.
+
+Covers FGP-01..FGP-04:
+  - FGP-01 test_fgp_match_returns_200: token issued with matching UA/lang →
+    request with same headers returns 200.
+  - FGP-02 test_fgp_mismatch_returns_401: token issued for one UA, request
+    arrives with different UA → 401 "Token fingerprint mismatch".
+  - FGP-03 test_no_fgp_claim_allowed: token manually crafted without "fgp"
+    key → 200 (graceful migration; tokens issued before Phase 7.4 keep
+    working).
+  - FGP-04 test_missing_headers_empty_string_binding: token issued with no
+    UA/lang (defaults to ""), request sent with no User-Agent / Accept-Language
+    headers → 200 (empty-string fingerprint matches).
+
+All four tests are xfail(strict=False) until Wave 1 (Plan 07.4-02) implements
+the fgp claim in services/auth.py and deps/auth.py.
+"""
+import uuid
+
+import pytest
+import pytest_asyncio
+from httpx import ASGITransport, AsyncClient
+from fastapi import FastAPI, Depends
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from tests.test_auth_api import FakeRedis
+
+
+# ── Minimal test app with /test/me route ──────────────────────────────────────
+
+
+def make_test_app():
+    """Create a minimal FastAPI app that exercises the auth deps.
+
+    Phase 7.4: app.state.redis is set to a FakeRedis() instance so the
+    NBF check and fgp check in get_current_user can call
+    request.app.state.redis without raising AttributeError.
+    """
+    from deps.auth import get_current_user
+    from db.models import User
+
+    test_app = FastAPI()
+
+    @test_app.get("/test/me")
+    async def get_me(current_user: User = Depends(get_current_user)):
+        return {"id": str(current_user.id), "role": current_user.role}
+
+    # Mount FakeRedis so NBF / fgp checks in get_current_user work
+    test_app.state.redis = FakeRedis()
+
+    return test_app
+
+
+@pytest_asyncio.fixture
+async def auth_client(db_session: AsyncSession):
+    """Async HTTP test client for the auth-dep test app."""
+    from deps.db import get_db
+
+    app = make_test_app()
+    app.dependency_overrides[get_db] = lambda: db_session
+
+    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as c:
+        yield c
+
+    app.dependency_overrides.clear()
+
+
+async def _create_user(db_session, role: str = "user", is_active: bool = True):
+    """Helper: insert a minimal User row into the test DB."""
+    from db.models import User
+    from services.auth import hash_password
+
+    user = User(
+        id=uuid.uuid4(),
+        handle=f"user_{uuid.uuid4().hex[:6]}",
+        email=f"{uuid.uuid4().hex[:6]}@example.com",
+        password_hash=hash_password("testpassword"),
+        role=role,
+        is_active=is_active,
+    )
+    db_session.add(user)
+    await db_session.commit()
+    return user
+
+
+# ── FGP stubs (Wave 0) ────────────────────────────────────────────────────────
+
+
+@pytest.mark.xfail(strict=False, reason="not implemented yet")
+@pytest.mark.asyncio
+async def test_fgp_match_returns_200(auth_client, db_session):
+    """FGP-01: token issued with matching UA/Accept-Language → 200."""
+    pytest.xfail("not implemented yet")
+
+
+@pytest.mark.xfail(strict=False, reason="not implemented yet")
+@pytest.mark.asyncio
+async def test_fgp_mismatch_returns_401(auth_client, db_session):
+    """FGP-02: token issued for one UA, request from different UA → 401."""
+    pytest.xfail("not implemented yet")
+
+
+@pytest.mark.xfail(strict=False, reason="not implemented yet")
+@pytest.mark.asyncio
+async def test_no_fgp_claim_allowed(auth_client, db_session):
+    """FGP-03: token without fgp claim → 200 (migration grace period)."""
+    pytest.xfail("not implemented yet")
+
+
+@pytest.mark.xfail(strict=False, reason="not implemented yet")
+@pytest.mark.asyncio
+async def test_missing_headers_empty_string_binding(auth_client, db_session):
+    """FGP-04: token issued with no headers (empty-string binding), request with no headers → 200."""
+    pytest.xfail("not implemented yet")