fix: corrige 6 bugs mineurs (BUG-035 a BUG-040)

tests/test_auth_api.py

@@ -137,6 +137,42 @@ class TestLogin:
         })
         assert resp.status_code == 401
 
+    def test_locked_account_returns_401_not_429(self, auth_client, monkeypatch):
+        """BUG-039: a locked account must be indistinguishable from an unknown one."""
+        import backend.auth.router as auth_router
+
+        monkeypatch.setattr(auth_router, "is_locked", lambda username: True)
+        resp = auth_client.post("/api/auth/login", json={
+            "username": "admin",
+            "password": "chab30",
+        })
+        assert resp.status_code == 401
+        assert "verrouill" not in resp.json()["detail"].lower()
+
+    def test_account_rate_limited_returns_401(self, auth_client, monkeypatch):
+        """BUG-039: per-account throttling must not reveal the account exists."""
+        import backend.auth.router as auth_router
+
+        monkeypatch.setattr(auth_router, "is_account_rate_limited", lambda username: True)
+        resp = auth_client.post("/api/auth/login", json={
+            "username": "admin",
+            "password": "chab30",
+        })
+        assert resp.status_code == 401
+
+    def test_inactive_account_returns_401(self, auth_client, monkeypatch):
+        """BUG-039: a disabled account answers like an unknown user."""
+        import backend.auth.router as auth_router
+
+        monkeypatch.setattr(auth_router, "get_user", lambda username: {
+            "username": username, "active": False, "password_hash": "x",
+        })
+        resp = auth_client.post("/api/auth/login", json={
+            "username": "admin",
+            "password": "chab30",
+        })
+        assert resp.status_code == 401
+
     def test_login_remember_me(self, auth_client):
         resp = auth_client.post("/api/auth/login", json={
             "username": "admin",