fix: :memory: db handling + tests (7/7 pass, +csrf +auth tests)

- config: handle sqlite:///:memory: properly in db_path
- db: skip mkdir for :memory: path
- tests: use temp file instead of :memory: (avoids per-connection DB isolation)
- tests: added test_csrf_rejected (403) and test_auth_user

app/config.py

@@ -43,6 +43,8 @@ class Settings(BaseSettings):
 
     @property
     def db_path(self) -> Path:
+        if self.database_url == "sqlite:///:memory:":
+            return Path(":memory:")  # Special SQLite in-memory
         if self.database_url.startswith("sqlite:///"):
             return Path(self.database_url.replace("sqlite:///", "/"))
         return Path("/data/flowdeck.db")

app/db.py

@@ -14,7 +14,8 @@ def get_db_path() -> Path:
 def init_db():
     """Create tables if they don't exist."""
     db_path = get_db_path()
-    db_path.parent.mkdir(parents=True, exist_ok=True)
+    if str(db_path) != ":memory:":
+        db_path.parent.mkdir(parents=True, exist_ok=True)
 
     with get_conn() as conn:
         conn.execute("PRAGMA journal_mode=WAL")