Initial commit: clean project structure

- Backend: FastAPI + SQLAlchemy + Celery (Python 3.11+)
- Frontend: Vue 3 + TypeScript + Pinia + Tailwind
- Admin Frontend: separate Vue 3 app for management
- Docker Compose: 9 services orchestration
- Specs: design prototypes, memory system PRD, product roadmap

Cleanup performed:
- Removed temporary debug scripts from backend root
- Removed deprecated admin_app.py (embedded UI)
- Removed duplicate docs from admin-frontend
- Updated .gitignore for Vite cache and egg-info

backend/tests/test_auth.py

@@ -0,0 +1,65 @@
+"""认证相关测试。"""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.core.security import create_access_token, decode_access_token
+
+
+class TestJWT:
+    """JWT token 测试。"""
+
+    def test_create_and_decode_token(self):
+        """测试 token 创建和解码。"""
+        payload = {"sub": "github:12345"}
+        token = create_access_token(payload)
+        decoded = decode_access_token(token)
+        assert decoded is not None
+        assert decoded["sub"] == "github:12345"
+
+    def test_decode_invalid_token(self):
+        """测试无效 token 解码。"""
+        result = decode_access_token("invalid-token")
+        assert result is None
+
+    def test_decode_empty_token(self):
+        """测试空 token 解码。"""
+        result = decode_access_token("")
+        assert result is None
+
+
+class TestSession:
+    """Session 端点测试。"""
+
+    def test_session_without_auth(self, client: TestClient):
+        """未登录时获取 session。"""
+        response = client.get("/auth/session")
+        assert response.status_code == 200
+        data = response.json()
+        assert data["user"] is None
+
+    def test_session_with_auth(self, auth_client: TestClient, test_user):
+        """已登录时获取 session。"""
+        response = auth_client.get("/auth/session")
+        assert response.status_code == 200
+        data = response.json()
+        assert data["user"] is not None
+        assert data["user"]["id"] == test_user.id
+        assert data["user"]["name"] == test_user.name
+
+    def test_session_with_invalid_token(self, client: TestClient):
+        """无效 token 获取 session。"""
+        client.cookies.set("access_token", "invalid-token")
+        response = client.get("/auth/session")
+        assert response.status_code == 200
+        data = response.json()
+        assert data["user"] is None
+
+
+class TestSignout:
+    """登出测试。"""
+
+    def test_signout(self, auth_client: TestClient):
+        """测试登出。"""
+        response = auth_client.post("/auth/signout", follow_redirects=False)
+        assert response.status_code == 302