test: suite pytest (36 tests) et CI Gitea Actions

Modèles (chemin DB, migration 0.1.0, ordre, réconciliation),
classification, client Gitea (pagination, en-tête, écritures),
API (CSRF, write-back, codes d'erreur, 502 propre), auth Basic
et fail-closed. Tous verts; pyflakes propre.

tests/test_auth.py

@@ -0,0 +1,36 @@
+"""Basic auth + fail-closed behaviour (audit C2)."""
+
+import base64
+
+from fastapi.testclient import TestClient
+
+import app.main as main
+
+
+def _basic(user: str, password: str) -> dict:
+    raw = base64.b64encode(f"{user}:{password}".encode()).decode()
+    return {"Authorization": f"Basic {raw}"}
+
+
+def test_no_credentials_means_open_but_health_works(client):
+    assert client.get("/").status_code == 200
+
+
+def test_auth_required_when_configured(monkeypatch, fake_gitea):
+    monkeypatch.setenv("KANBANTE_AUTH_USER", "bruno")
+    monkeypatch.setenv("KANBANTE_AUTH_PASSWORD", "motdepasse")
+    with TestClient(main.app) as client:
+        assert client.get("/").status_code == 401
+        assert client.get("/", headers=_basic("bruno", "mauvais")).status_code == 401
+        assert client.get("/", headers=_basic("bruno", "motdepasse")).status_code == 200
+        # Liveness stays public for Docker HEALTHCHECK.
+        assert client.get("/api/health").status_code == 200
+
+
+def test_require_auth_fails_closed_without_credentials(monkeypatch, fake_gitea):
+    monkeypatch.delenv("KANBANTE_AUTH_USER", raising=False)
+    monkeypatch.delenv("KANBANTE_AUTH_PASSWORD", raising=False)
+    monkeypatch.setenv("KANBANTE_REQUIRE_AUTH", "1")
+    with TestClient(main.app) as client:
+        assert client.get("/").status_code == 503
+        assert client.get("/api/health").status_code == 200