feat: magic-link auth with access requests and RBAC

backend/app/auth/schemas.py

@@ -0,0 +1,49 @@
+"""Pydantic contracts for the access/auth API."""
+
+from datetime import datetime
+from uuid import UUID
+
+from pydantic import BaseModel, Field
+
+
+class AccessRequestCreate(BaseModel):
+    name: str = Field(min_length=1, max_length=200)
+    email: str = Field(min_length=3, max_length=320)
+    reason: str = Field(default="", max_length=2000)
+
+
+class AccessRequestRead(BaseModel):
+    id: UUID
+    name: str
+    email: str
+    reason: str
+    status: str
+    created_at: datetime
+    decided_at: datetime | None
+    decided_by: str | None
+
+
+class AccessDecisionRead(BaseModel):
+    request: AccessRequestRead
+    # False when SMTP is unset (dev): the magic link is logged, not mailed.
+    email_sent: bool
+
+
+class MagicConsumeRequest(BaseModel):
+    token: str = Field(min_length=1, max_length=200)
+
+
+class MeRead(BaseModel):
+    id: UUID
+    email: str
+    name: str
+    role: str
+    tenant_id: str
+
+
+class AdminBootstrapRequest(BaseModel):
+    email: str = Field(min_length=3, max_length=320)
+
+
+class MessageRead(BaseModel):
+    message: str