feat: rebuild as multi-user web agent

tests/test_auth.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+
+import pytest
+from fastapi import HTTPException
+
+from agent_platform.auth import decode_openwebui_identity, verify_service_bearer
+
+
+def test_signed_identity_is_verified(identity_jwt: str, settings) -> None:
+    identity = decode_openwebui_identity(identity_jwt, settings.openwebui_forward_jwt_secret)
+    assert identity.user_id == "user-123"
+    assert identity.email == "user@example.test"
+
+
+def test_invalid_identity_is_rejected(settings) -> None:
+    with pytest.raises(HTTPException) as error:
+        decode_openwebui_identity("not-a-jwt", settings.openwebui_forward_jwt_secret)
+    assert error.value.status_code == 401
+
+
+def test_service_bearer_uses_exact_match() -> None:
+    verify_service_bearer("Bearer expected", "expected")
+    with pytest.raises(HTTPException) as error:
+        verify_service_bearer("Bearer expect", "expected")
+    assert error.value.status_code == 401