refactor: form-core wiring, JWT sessions, slowapi, packaging, frontend rewrite, test declutter

backend/migrations/versions/c4d8f2a1e6b9_drop_user_sessions.py

@@ -0,0 +1,46 @@
+"""drop user_sessions (stateless JWT sessions)
+
+Revision ID: c4d8f2a1e6b9
+Revises: b7e2d4a1c9f3
+Create Date: 2026-09-28 00:00:00.000000
+
+Sessions are stateless HS256 JWTs in the HttpOnly cookie (see
+app/auth/service.py mint_session_token). All sessions are invalidated
+at deploy — users re-login via magic link.
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+import sqlmodel
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "c4d8f2a1e6b9"
+down_revision: str | Sequence[str] | None = "b7e2d4a1c9f3"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    op.drop_index(op.f("ix_user_sessions_user_id"), table_name="user_sessions")
+    op.drop_table("user_sessions")
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    op.create_table(
+        "user_sessions",
+        sa.Column("id", sqlmodel.sql.sqltypes.AutoString(length=128), nullable=False),
+        sa.Column("user_id", sa.Uuid(), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
+        sa.ForeignKeyConstraint(
+            ["user_id"],
+            ["users.id"],
+        ),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(op.f("ix_user_sessions_user_id"), "user_sessions", ["user_id"], unique=False)