feat: add cookie sessions and backend role authorization

backend/tests/test_migrations.py

@@ -16,7 +16,7 @@ def test_startup_requires_migration(database):
 
 
 def test_startup_rejects_previous_schema(database):
-    migrate(database, "0002_catalog")
+    migrate(database, "0003_retrieval_runs")
     with pytest.raises(RuntimeError, match="alembic upgrade head"):
         with TestClient(create_app(database)):
             pass
@@ -42,10 +42,34 @@ def test_upgrade_preserves_original_rows_and_repeated_upgrade(database):
         assert connection.scalar(text("SELECT count(*) FROM audit_events")) == 2
         assert (
             connection.scalar(text("SELECT version_num FROM alembic_version"))
-            == "0003_retrieval_runs"
+            == "0004_auth_sessions"
         )
         assert compare_metadata(MigrationContext.configure(connection), Base.metadata) == []
     migrate(database, "0001_baseline", downgrade=True)
     with database.connect() as connection:
         assert connection.scalar(text("SELECT content FROM knowledge_items")) == "原始正文"
     migrate(database)
+
+
+def test_auth_upgrade_and_downgrade_preserve_knowledge_and_retrieval(database):
+    migrate(database, "0003_retrieval_runs")
+    with database.begin() as c:
+        c.execute(
+            text("""INSERT INTO knowledge_items
+        (title, category, content, verification_status, version, updated_at, is_deleted)
+        VALUES ('占位', '其他', '保留的占位正文', 'pending', 1, now(), false)""")
+        )
+        c.execute(
+            text("""INSERT INTO retrieval_runs
+        (id, query, mode, corpus_fingerprint, response)
+        VALUES ('00000000-0000-0000-0000-000000000001', '占位', 'keyword', 'placeholder', '{}')""")
+        )
+    migrate(database)
+    with database.connect() as c:
+        assert c.scalar(text("SELECT count(*) FROM users")) == 0
+        assert c.scalar(text("SELECT count(*) FROM auth_sessions")) == 0
+    migrate(database, "0003_retrieval_runs", downgrade=True)
+    with database.connect() as c:
+        assert c.scalar(text("SELECT content FROM knowledge_items")) == "保留的占位正文"
+        assert c.scalar(text("SELECT count(*) FROM retrieval_runs")) == 1
+    migrate(database)