feat: add test suites for backup schedules, service config, auth token, bookmarks, content permissions, devii adopt, and devrant auth

Add comprehensive test coverage for seven new API areas:
- Backup schedules CRUD operations in admin panel
- Service configuration saving and retrieval for news AI model
- Token authentication with email/username and JSON body support
- Bookmarking for project and news targets with invalid type validation
- Content permissions testing with member and admin session fixtures
- Devii adopt endpoint redirect behavior and session cookie handling
- Devrant authentication flow with user registration and token retrieval

tests/api/bookmarks/index.py

@@ -221,3 +221,39 @@ def test_bookmark_requires_login(app_server):
     )
     assert r.status_code == 303
     assert get_table("bookmarks").count(target_uid=post_uid) == 0
+
+
+def test_bookmark_project_target(app_server):
+    s, name = _session_bookmarks()
+    project_uid = generate_uid()
+    r = s.post(
+        f"{BASE_URL}/bookmarks/project/{project_uid}", headers=AJAX_bookmarks
+    )
+    assert r.json()["saved"] is True
+    assert (
+        get_table("bookmarks").count(
+            target_type="project", target_uid=project_uid, deleted_at=None
+        )
+        == 1
+    )
+
+
+def test_bookmark_news_target(app_server):
+    s, name = _session_bookmarks()
+    news_uid = generate_uid()
+    r = s.post(f"{BASE_URL}/bookmarks/news/{news_uid}", headers=AJAX_bookmarks)
+    assert r.json()["saved"] is True
+    assert (
+        get_table("bookmarks").count(
+            target_type="news", target_uid=news_uid, deleted_at=None
+        )
+        == 1
+    )
+
+
+def test_bookmark_invalid_target_type_400(app_server):
+    s, name = _session_bookmarks()
+    r = s.post(
+        f"{BASE_URL}/bookmarks/comment/{generate_uid()}", headers=AJAX_bookmarks
+    )
+    assert r.status_code == 400