fix: :memory: db handling + tests (7/7 pass, +csrf +auth tests)

- config: handle sqlite:///:memory: properly in db_path
- db: skip mkdir for :memory: path
- tests: use temp file instead of :memory: (avoids per-connection DB isolation)
- tests: added test_csrf_rejected (403) and test_auth_user

app/db.py

@@ -14,7 +14,8 @@ def get_db_path() -> Path:
 def init_db():
     """Create tables if they don't exist."""
     db_path = get_db_path()
-    db_path.parent.mkdir(parents=True, exist_ok=True)
+    if str(db_path) != ":memory:":
+        db_path.parent.mkdir(parents=True, exist_ok=True)
 
     with get_conn() as conn:
         conn.execute("PRAGMA journal_mode=WAL")