fix: :memory: db handling + tests (7/7 pass, +csrf +auth tests)

- config: handle sqlite:///:memory: properly in db_path
- db: skip mkdir for :memory: path
- tests: use temp file instead of :memory: (avoids per-connection DB isolation)
- tests: added test_csrf_rejected (403) and test_auth_user

app/config.py

@@ -43,6 +43,8 @@ class Settings(BaseSettings):
 
     @property
     def db_path(self) -> Path:
+        if self.database_url == "sqlite:///:memory:":
+            return Path(":memory:")  # Special SQLite in-memory
         if self.database_url.startswith("sqlite:///"):
             return Path(self.database_url.replace("sqlite:///", "/"))
         return Path("/data/flowdeck.db")