feat: add test suites for backup schedules, service config, auth token, bookmarks, content permissions, devii adopt, and devrant auth

Add comprehensive test coverage for seven new API areas:
- Backup schedules CRUD operations in admin panel
- Service configuration saving and retrieval for news AI model
- Token authentication with email/username and JSON body support
- Bookmarking for project and news targets with invalid type validation
- Content permissions testing with member and admin session fixtures
- Devii adopt endpoint redirect behavior and session cookie handling
- Devrant authentication flow with user registration and token retrieval

tests/api/auth/token.py

@@ -0,0 +1,124 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table, refresh_snapshot, set_setting
+
+_counter_token = [0]
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _token_settings(app_server):
+    for key, value in {
+        "rate_limit_per_minute": "1000000",
+        "rate_limit_window_seconds": "60",
+        "registration_open": "1",
+        "maintenance_mode": "0",
+        "session_max_age_days": "7",
+    }.items():
+        set_setting(key, value)
+    yield
+
+
+def _signup(password="secret123"):
+    _counter_token[0] += 1
+    name = f"tok{int(time.time() * 1000)}{_counter_token[0]}"
+    email = f"{name}@t.dev"
+    requests.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": email,
+            "password": password,
+            "confirm_password": password,
+        },
+        allow_redirects=True,
+    )
+    return name, email, password
+
+
+def test_token_happy_path_with_email(app_server):
+    name, email, password = _signup()
+    r = requests.post(f"{BASE_URL}/auth/token", data={"email": email, "password": password})
+    assert r.status_code == 200, r.text[:300]
+    body = r.json()
+    assert body["access_token"] and len(body["access_token"]) >= 32
+    assert body["token_type"]
+    assert isinstance(body["expires_in"], int) and body["expires_in"] > 0
+
+
+def test_token_accepts_username_as_identifier(app_server):
+    name, email, password = _signup()
+    r = requests.post(f"{BASE_URL}/auth/token", data={"email": name, "password": password})
+    assert r.status_code == 200, r.text[:300]
+    assert r.json()["access_token"]
+
+
+def test_token_via_json_body(app_server):
+    name, email, password = _signup()
+    r = requests.post(
+        f"{BASE_URL}/auth/token",
+        json={"email": email, "password": password},
+        headers={"Content-Type": "application/json"},
+    )
+    assert r.status_code == 200, r.text[:300]
+    assert r.json()["access_token"]
+
+
+def test_token_wrong_password_401(app_server):
+    name, email, password = _signup()
+    r = requests.post(f"{BASE_URL}/auth/token", data={"email": email, "password": "nope!!"})
+    assert r.status_code == 401
+    assert "access_token" not in r.json()
+
+
+def test_token_unknown_identifier_401(app_server):
+    r = requests.post(
+        f"{BASE_URL}/auth/token",
+        data={"email": "no_such_user_zzz@t.dev", "password": "whatever"},
+    )
+    assert r.status_code == 401
+
+
+def test_token_empty_password_rejected(app_server):
+    name, email, password = _signup()
+    r = requests.post(
+        f"{BASE_URL}/auth/token",
+        headers={"Accept": "application/json"},
+        data={"email": email, "password": ""},
+    )
+    assert r.status_code in (400, 401, 422)
+    assert "access_token" not in r.json()
+
+
+def test_token_inactive_account_403(app_server):
+    name, email, password = _signup()
+    users = get_table("users")
+    row = users.find_one(username=name)
+    users.update({"uid": row["uid"], "is_active": False}, ["uid"])
+    refresh_snapshot()
+    try:
+        r = requests.post(
+            f"{BASE_URL}/auth/token", data={"email": email, "password": password}
+        )
+        assert r.status_code == 403, r.text[:300]
+        assert "access_token" not in r.json()
+    finally:
+        users.update({"uid": row["uid"], "is_active": True}, ["uid"])
+        refresh_snapshot()
+
+
+def test_token_is_usable_as_bearer_credential(app_server):
+    name, email, password = _signup()
+    token = requests.post(
+        f"{BASE_URL}/auth/token", data={"email": email, "password": password}
+    ).json()["access_token"]
+    target, _, _ = _signup()
+    r = requests.post(
+        f"{BASE_URL}/follow/{target}",
+        headers={"Authorization": f"Bearer {token}"},
+        allow_redirects=False,
+    )
+    assert r.status_code in (200, 302), r.text[:200]