fix: :memory: db handling + tests (7/7 pass, +csrf +auth tests)

- config: handle sqlite:///:memory: properly in db_path
- db: skip mkdir for :memory: path
- tests: use temp file instead of :memory: (avoids per-connection DB isolation)
- tests: added test_csrf_rejected (403) and test_auth_user

tests/test_app.py

@@ -1,19 +1,27 @@
 """FlowDeck — Basic tests."""
+import os
+import tempfile
 import pytest
 from fastapi.testclient import TestClient
 
 
 @pytest.fixture
 def client():
-    import os
+    db_file = tempfile.NamedTemporaryFile(suffix=".db", delete=False)
+    db_path = db_file.name
+    db_file.close()
+
     os.environ["GITEA_URL"] = "https://git.dracodev.net"
     os.environ["GITEA_TOKEN"] = "test"
-    os.environ["DATABASE_URL"] = "sqlite:///:memory:"
+    os.environ["DATABASE_URL"] = f"sqlite:///{db_path}"
 
     from app.main import app
     from app.db import init_db
     init_db()
-    return TestClient(app)
+
+    yield TestClient(app)
+
+    os.unlink(db_path)
 
 
 def test_health(client):
@@ -44,5 +52,17 @@ def test_projects(client):
 
 def test_board_404(client):
     resp = client.get("/board/test/test")
-    # Should render or return error, not crash
     assert resp.status_code in (200, 500)
+
+
+def test_csrf_rejected(client):
+    """POST without CSRF token should return 403."""
+    resp = client.post("/api/move?owner=x&repo=y&issue_id=1&column=Test")
+    assert resp.status_code == 403
+
+
+def test_auth_user(client):
+    resp = client.get("/auth/user")
+    assert resp.status_code == 200
+    data = resp.json()
+    assert "authenticated" in data