feat(04-01): add Wave 0 xfail stubs for DOC-02, ADMIN-06, SEC-08, SEC-09

- test_documents.py: append 4 stubs (content_stream 200, 206, admin_403, no_presigned_url)
- test_audit.py: create new file with 4 stubs (viewer, no_doc_content, user_403, export_csv)
- test_security.py: create new file with 2 stubs (credentials_enc_not_in_response, delete_user_cleans_files)
- All stubs: xfail(strict=False), body is pytest.xfail("not implemented yet")

backend/tests/test_documents.py

@@ -336,3 +336,32 @@ async def test_documents_require_auth(async_client):
     """
     resp = await async_client.get("/api/documents")
     assert resp.status_code in (401, 403), f"Expected 401 or 403, got {resp.status_code}"
+
+
+# ---------------------------------------------------------------------------
+# Wave 0 xfail stubs for Phase 4 DOC-02 proxy / content-stream tests
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.xfail(strict=False)
+async def test_content_stream_200(async_client, auth_user):
+    """GET /api/documents/{id}/content returns 200 with correct Content-Type and Content-Disposition: inline."""
+    pytest.xfail("not implemented yet")
+
+
+@pytest.mark.xfail(strict=False)
+async def test_content_stream_206_range(async_client, auth_user):
+    """GET /api/documents/{id}/content with Range header returns 206 and Content-Range header."""
+    pytest.xfail("not implemented yet")
+
+
+@pytest.mark.xfail(strict=False)
+async def test_content_stream_admin_403(async_client, admin_user):
+    """GET /api/documents/{id}/content with admin JWT returns 403."""
+    pytest.xfail("not implemented yet")
+
+
+@pytest.mark.xfail(strict=False)
+async def test_content_stream_no_presigned_url(async_client, auth_user):
+    """GET /api/documents/{id}/content response body does not contain any presigned URL token."""
+    pytest.xfail("not implemented yet")