refactor: form-core wiring, JWT sessions, slowapi, packaging, frontend rewrite, test declutter

backend/tests/_harness.py

@@ -66,3 +66,42 @@ def migrate_throwaway(backend_dir: Path) -> None:
     cfg = Config()
     cfg.set_main_option("script_location", str(backend_dir / "migrations"))
     alembic_command.upgrade(cfg, "head")
+
+
+# Single constant: lfx prefers LANGFLOW_API_KEY over LFX_API_KEY, so the
+# repo .env value must be cleared wherever a test key is used.
+TEST_LFX_KEY = "test-lfx-key"
+
+
+def spawn_uvicorn(app, host: str = "127.0.0.1", port: int = 0):  # type: ignore[no-untyped-def]
+    """Real uvicorn server in a daemon thread. Returns (server, thread)."""
+    import threading
+    import time
+
+    import uvicorn
+
+    config = uvicorn.Config(app, host=host, port=port, log_level="warning")
+    server = uvicorn.Server(config)
+    thread = threading.Thread(target=server.run, daemon=True)
+    thread.start()
+    deadline = time.time() + 30
+    while not server.started and time.time() < deadline:
+        time.sleep(0.05)
+    assert server.started, "uvicorn test server did not start"
+    return server, thread
+
+
+def plant_session_jwt(session, email: str, role: str = "admin", name: str = "Test") -> object:
+    """Idempotent test user + session JWT (shared with smoke pattern)."""
+    from sqlmodel import select
+
+    from app.auth import service
+    from app.models import User
+
+    user = session.exec(select(User).where(User.email == email)).first()
+    if user is None:
+        user = User(name=name, email=email, role=role)
+        session.add(user)
+        session.commit()
+        session.refresh(user)
+    return user, service.mint_session_token(user)