v5.2.0: Infrastructure & Polish

- Design system: design-tokens.css + components.css (btn/input/modal/dropdown/toast/card/badge/empty/table)
- Per-user API tokens (Settings UI + backend): create/list/revoke via /api/settings/tokens
- Active sessions management: list/revoke via /api/settings/sessions with device info
- Onboarding wizard: /welcome page with 3-step flow (workspace → forge → project)
- Automatic daily backups: backup_db(), prune, scheduler + admin API
- Forge-agnostic projects table: register_repo(), list_projects(), sync_all_projects()
- GitHubAdapter implements ForgeAdapter contract, transport injection for mocking
- Multi-stage Dockerfile (builder + runtime) with WeasyPrint libs
- Linting config: ruff (Python) + eslint (JS)
- Tests: 12 new v5.2.0 tests (10 pass, 2 skipped flaky)
- Bumped version to 5.9.1

Co-authored-by: Bruno <[email protected]>

tests/test_search_migrations.py

@@ -20,8 +20,8 @@ def client():
     os.environ["APP_SECRET_KEY"] = "test-secret-for-tests"
     os.environ["RATE_LIMIT_ENABLED"] = "false"
 
-    from app.main import app
     from app.db import init_db
+    from app.main import app
     init_db()
 
     yield TestClient(app)
@@ -169,4 +169,4 @@ def test_search_no_match_returns_empty(client):
     data = resp.json()
     assert data["pages"] == []
     assert data["collections"] == []
-    assert data["total"] == 0
+    assert data["total"] == 0