test: met à jour les tests suite à la suppression du fallback admin token

Tous les tests *_no_auth doivent maintenant retourner 401 au lieu de 200/502
car _require_gitea() ne fait plus de fallback vers le token admin global.

tests/test_app.py

@@ -1014,9 +1014,9 @@ def test_pwa_manifest(client):
 # ══════════════════════════════════════════════════════
 
 def test_upload_no_auth(client):
-    """POST /api/gitea/projects/owner/repo/upload — 400 for missing file (checked before auth with admin fallback)."""
+    """POST /api/gitea/projects/owner/repo/upload — 401 without Gitea token."""
     resp = client.post("/api/gitea/projects/testowner/testrepo/upload")
-    assert resp.status_code == 400  # missing file → 400 before auth check
+    assert resp.status_code == 401  # no Gitea token → 401
 
 
 def test_upload_missing_file(client):
@@ -1081,11 +1081,11 @@ def test_upload_with_session_no_file(client):
 def test_sync_labels_no_auth(client):
     """POST /api/gitea/projects/owner/repo/sync-labels — requires session."""
     resp = client.post("/api/gitea/projects/testowner/testrepo/sync-labels")
-    assert resp.status_code in (401, 502)
+    assert resp.status_code == 401  # no session → 401
 
 
 def test_sync_labels_with_session_no_gitea(client):
-    """POST sync-labels — 502 when session exists but no Gitea OAuth token (admin fallback)."""
+    """POST sync-labels — 401 when session exists but no Gitea OAuth token."""
     from app.db import get_conn
     with get_conn() as conn:
         conn.execute("INSERT INTO users (login, full_name, email) VALUES ('syncuser', 'Sync', '[email protected]')")
@@ -1097,8 +1097,8 @@ def test_sync_labels_with_session_no_gitea(client):
         "/api/gitea/projects/owner/repo/sync-labels",
         cookies={"flowdeck_session": session},
     )
-    # Admin token fallback → tries to sync labels on fake repo → 502
-    assert resp.status_code in (200, 502)
+    # No Gitea OAuth token → 401
+    assert resp.status_code == 401
     with get_conn() as conn:
         conn.execute("DELETE FROM users WHERE id=?", (uid,))
         conn.commit()
@@ -1134,9 +1134,9 @@ def test_sync_labels_with_gitea_token(client):
 # ══════════════════════════════════════════════════════
 
 def test_commits_no_auth(client):
-    """GET /api/gitea/projects/owner/repo/commits — admin fallback works."""
+    """GET /api/gitea/projects/owner/repo/commits — 401 without Gitea token."""
     resp = client.get("/api/gitea/projects/owner/repo/commits")
-    assert resp.status_code in (200, 502)  # admin token may succeed or fail
+    assert resp.status_code == 401  # no Gitea token → 401
 
 
 def test_commits_with_path(client):
@@ -1164,15 +1164,15 @@ def test_commits_with_path(client):
 
 
 def test_commits_empty_path(client):
-    """GET commits without path param — tests default empty path."""
+    """GET commits without path param — 401 without Gitea token."""
     resp = client.get("/api/gitea/projects/owner/repo/commits?path=")
-    assert resp.status_code in (200, 502)
+    assert resp.status_code == 401  # no Gitea token → 401
 
 
 def test_commits_special_chars_path(client):
-    """GET commits with special characters in path."""
+    """GET commits with special characters in path — 401 without Gitea token."""
     resp = client.get("/api/gitea/projects/owner/repo/commits?path=src/components/Header%20Component.tsx")
-    assert resp.status_code in (200, 502)
+    assert resp.status_code == 401  # no Gitea token → 401
 
 
 # ══════════════════════════════════════════════════════
@@ -1180,11 +1180,11 @@ def test_commits_special_chars_path(client):
 # ══════════════════════════════════════════════════════
 
 def test_file_create_no_auth(client):
-    """PUT /api/gitea/projects/owner/repo/file — 502 for fake repo (admin fallback)."""
+    """PUT /api/gitea/projects/owner/repo/file — 401 without Gitea token."""
     resp = client.put("/api/gitea/projects/owner/repo/file", json={
         "path": "test.md", "content": "# Hello", "message": "test"
     })
-    assert resp.status_code == 502  # admin token hits fake repo → 502
+    assert resp.status_code == 401  # no Gitea token → 401
 
 
 def test_file_create_missing_path(client):
@@ -1795,39 +1795,39 @@ def test_auth_user_unauthenticated(client):
 # ══════════════════════════════════════════════════════
 
 def test_gitea_labels_no_auth(client):
-    """GET /api/gitea/projects/owner/repo/labels — 502 for fake repo (admin fallback tries real API)."""
+    """GET /api/gitea/projects/owner/repo/labels — 401 without Gitea token."""
     resp = client.get("/api/gitea/projects/owner/repo/labels")
-    assert resp.status_code == 502  # admin token hits fake repo → Gitea 404 → 502
+    assert resp.status_code == 401  # no Gitea token → 401
 
 
 def test_gitea_tree_no_auth(client):
-    """GET /api/gitea/projects/owner/repo/tree — 502 for fake repo (admin fallback)."""
+    """GET /api/gitea/projects/owner/repo/tree — 401 without Gitea token."""
     resp = client.get("/api/gitea/projects/owner/repo/tree")
-    assert resp.status_code == 502
+    assert resp.status_code == 401  # no Gitea token → 401
 
 
 def test_gitea_file_get_no_auth(client):
-    """GET /api/gitea/projects/owner/repo/file?path=x — 502 for fake repo (admin fallback)."""
+    """GET /api/gitea/projects/owner/repo/file?path=x — 401 without Gitea token."""
     resp = client.get("/api/gitea/projects/owner/repo/file?path=README.md")
-    assert resp.status_code == 502
+    assert resp.status_code == 401  # no Gitea token → 401
 
 
 def test_gitea_orgs_no_auth(client):
-    """GET /api/gitea/orgs — admin token fallback (may fail in test env)."""
+    """GET /api/gitea/orgs — 401 without Gitea token."""
     resp = client.get("/api/gitea/orgs")
-    assert resp.status_code in (200, 502)  # admin token may fail in test environment
+    assert resp.status_code == 401  # no Gitea token → 401
 
 
 def test_gitea_projects_no_auth(client):
-    """GET /api/gitea/projects — admin token fallback (may fail in test env)."""
+    """GET /api/gitea/projects — 401 without Gitea token."""
     resp = client.get("/api/gitea/projects")
-    assert resp.status_code in (200, 502)
+    assert resp.status_code == 401  # no Gitea token → 401
 
 
 def test_gitea_file_delete_no_auth(client):
-    """DELETE /api/gitea/projects/owner/repo/file — 502 for fake repo (admin fallback)."""
+    """DELETE /api/gitea/projects/owner/repo/file — 401 without Gitea token."""
     resp = client.delete("/api/gitea/projects/owner/repo/file?path=test.md&sha=abc")
-    assert resp.status_code == 502  # admin token hits fake repo → Gitea 404 → 502
+    assert resp.status_code == 401  # no Gitea token → 401
 
 
 def test_gitea_file_delete_missing_params(client):