fix(fgp): add null-byte separator in HMAC input to prevent concatenation collision

Without a separator, UA='foobar'+AL='' and UA='foo'+AL='bar' produced the same
HMAC input, allowing a token fingerprint to match a different header split.
Fix: use '\x00' as separator between user_agent and accept_lang fields.

Regression test added: test_fgp_no_concatenation_collision (FGP-05).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/services/auth.py

@@ -88,7 +88,7 @@ def _compute_fgp(user_agent: str, accept_lang: str) -> str:
     """Return 16-char hex fingerprint binding a token to its client context (D-04)."""
     return hmac.new(
         settings.secret_key.encode(),
-        (user_agent + accept_lang).encode(),
+        (user_agent + "\x00" + accept_lang).encode(),
         hashlib.sha256,
     ).hexdigest()[:16]