feat: add test suites for backup schedules, service config, auth token, bookmarks, content permissions, devii adopt, and devrant auth

Add comprehensive test coverage for seven new API areas:
- Backup schedules CRUD operations in admin panel
- Service configuration saving and retrieval for news AI model
- Token authentication with email/username and JSON body support
- Bookmarking for project and news targets with invalid type validation
- Content permissions testing with member and admin session fixtures
- Devii adopt endpoint redirect behavior and session cookie handling
- Devrant authentication flow with user registration and token retrieval

tests/api/devii/adopt.py

@@ -0,0 +1,41 @@
+# retoor <retoor@molodetz.nl>
+
+import pytest
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import set_setting
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _settings(app_server):
+    set_setting("rate_limit_per_minute", "1000000")
+    yield
+
+
+def test_adopt_redirects_to_default(app_server):
+    r = requests.get(f"{BASE_URL}/devii/adopt", allow_redirects=False)
+    assert r.status_code == 303
+    assert r.headers["location"] == "/"
+
+
+def test_adopt_honours_safe_next(app_server):
+    r = requests.get(
+        f"{BASE_URL}/devii/adopt", params={"next": "/feed"}, allow_redirects=False
+    )
+    assert r.status_code == 303
+    assert r.headers["location"] == "/feed"
+
+
+def test_adopt_rejects_external_next(app_server):
+    r = requests.get(
+        f"{BASE_URL}/devii/adopt",
+        params={"next": "https://evil.example.com/x"},
+        allow_redirects=False,
+    )
+    assert r.status_code == 303
+    assert not r.headers["location"].startswith("http")
+
+
+def test_adopt_without_pending_session_sets_no_cookie(app_server):
+    r = requests.get(f"{BASE_URL}/devii/adopt", allow_redirects=False)
+    assert "session" not in r.cookies