refactor: form-core wiring, JWT sessions, slowapi, packaging, frontend rewrite, test declutter

backend/scripts/smoke_e2e.py

@@ -37,6 +37,9 @@ LFX_PORT = _free_port()
 API_PORT = _free_port()
 LFX_KEY = "lfx-759GsfJKjAeOBZ_44-cll9WdHp_yfYn_tIg7eHG38Rs"
 
+# Stateless admin session JWT, minted in main() after planting the user.
+_SMOKE_JWT = ""
+
 
 def wait_healthy(url: str, timeout: int = 180) -> None:
     deadline = time.time() + timeout
@@ -54,9 +57,9 @@ def api(method: str, path: str, body: dict | None = None) -> tuple[int, dict | s
     import httpx
 
     with httpx.Client(base_url=f"http://127.0.0.1:{API_PORT}", timeout=120) as c:
-        # Management + runs are login-gated; the smoke admin session is
-        # planted directly in the throwaway DB (see main()).
-        c.cookies.set("kirche_session", "smoke-session", domain="127.0.0.1")
+        # Management + runs are login-gated; the smoke admin JWT is minted
+        # in main() (stateless sessions, see app/auth/service.py).
+        c.cookies.set("kirche_session", _SMOKE_JWT, domain="127.0.0.1")
         r = c.request(method, path, json=body)
         try:
             return r.status_code, r.json()
@@ -90,27 +93,31 @@ def main() -> None:
     app_settings.database_url = db_url
     alembic_command.upgrade(cfg, "head")
 
-    # Plant an admin session: management + runs require login, and there is
-    # no SMTP in smoke to deliver a magic link.
-    from datetime import UTC, datetime, timedelta
+    # Plant an admin user + mint its session JWT: management + runs
+    # require login, and there is no SMTP in smoke to deliver a magic link.
+    # Sessions are stateless (see app/auth/service.py) — the cookie value
+    # below is the JWT sent as `kirche_session`.
+    global _SMOKE_JWT
+    import os
 
     from sqlmodel import Session, create_engine
 
-    from app.models import User, UserSession
+    from app.auth import service as auth_service
+    from app.models import User
+    from app.settings import settings as app_settings
 
+    if not app_settings.jwt_secret:
+        app_settings.jwt_secret = os.environ.get(
+            "JWT_SECRET", "smoke-jwt-secret-32-chars-minimum!!"
+        )
     engine = create_engine(db_url)
     with Session(engine) as s:
         user = User(name="smoke", email="smoke@example.com", role="admin")
         s.add(user)
-        s.flush()
-        s.add(
-            UserSession(
-                id="smoke-session",
-                user_id=user.id,
-                expires_at=datetime.now(UTC) + timedelta(hours=1),
-            )
-        )
         s.commit()
+        s.refresh(user)
+        _SMOKE_JWT = auth_service.mint_session_token(user)
+        print("smoke admin JWT minted")
     engine.dispose()
 
     env = {