Characterize authentication, authorization, and account lifecycle

[DenWin]

Parent testing program: #16. Blocked by #17 and dependent on the harness in #18.

Scope

Add behavior-level characterization and regression tests for the existing authentication and account interface before the login redesign or session-persistence refactor.

Required tests

Setup and registration

• First-run setup redirects and account creation.
• Existing installation cannot repeat first-run setup.
• Registration enabled/disabled behavior.
• Duplicate email handling.
• Password hashing and no plaintext persistence.

Login and cookies

• Valid login redirects and creates an authentication cookie.
• Unknown email and wrong password return the same safe error.
• Cookie attributes: HttpOnly, SameSite=Strict, Secure unless HTTP_ALLOWED, and seven-day maximum age.
• Valid, missing, malformed, expired, and wrongly signed JWT behavior.
• Token user must still exist in the database.
• Login page redirects an already authenticated user.
• GET and POST logout remove the cookie.

Authorization

• Authenticated and unauthenticated route behavior.
• ALLOW_UNAUTHENTICATED with isolated and shared anonymous identities.
• Cross-user access is rejected for jobs, results, downloads, and deletion.
• Registration/account flags do not bypass authorization.

Account lifecycle

• Account page access.
• Email/password update with current-password verification.
• Duplicate email handling.
• Token behavior after account changes.

Restart contract

Capture the current restart invalidation behavior as evidence, then implement the intended persistent-session behavior through #11 using failing tests.

Acceptance criteria

• Tests exercise HTTP/cookie behavior through the application interface.
• Authentication tests use isolated users and database state.
• Security assertions avoid snapshots of secrets or hashes.
• Cross-user access tests cover every protected resource family.
• Current behavior is characterized before auth modules are refactored.
• Intended changes in Support explicit local, OIDC, and built-in authentication modes #11 follow red-green-refactor rather than freezing the known restart problem.