feat(api): identité user-first — login/password, ownership user, fin du token device

- 000006 : users.username/username_normalized/password_hash/is_admin, index
  unique partiel sur username_normalized, DROP idx_users_email (unicité V1 =
  username, jamais email) ; 000007 destructif : resources.owner_id→user_id
  (FK→users, reset base dev), l'unicité racine devient par user
- pkg/passwd : argon2id (t=1,m=64MiB,p=4,k=32), comparaison constant-time,
  VerifyTimedEqual (délai égalisé dummy-hash) ; pkg/auth : subject=user_id +
  claim device_id, TTL 7 j sans refresh
- repository : Users (count/get/resolve-exact/create/update-password/
  mark-deleted), Devices.MarkUser (user_id INFORMATIF uniquement)
- handlers : POST /devices sans token, POST /auth/login (401 indistinguable
  user inconnu/mauvais mdp, device requis), PATCH /users/me/password
  (current_password, tokens non révoqués — limite V1), GET /users/resolve
  (exact lowercase, jamais email/is_admin) ; middleware RequireAuth
  (user authorisant, device porté) ; tout le scoping ressources passe user
- bootstrap admin : users vide + ADMIN_* absents → refus de démarrer ;
  .env.example ; docs/api-v1.md §2/§3/§7/§8
- tests : migrations 000006/000007 (up/down), pkg/auth Identity, handlers
  login/password/resolve, helpers refactorés registerAndLogin, repo tests
  scopés user — suite backend verte

backend/pkg/auth/auth_test.go

@@ -3,6 +3,14 @@ package auth
 import (
 	"strings"
 	"testing"
+	"time"
+
+	"aidanwoods.dev/go-paseto"
+)
+
+const (
+	testUserID   = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	testDeviceID = "0123456789abcdef0123456789abcdef"
 )
 
 func TestIssueVerifyRoundtrip(t *testing.T) {
@@ -11,8 +19,7 @@ func TestIssueVerifyRoundtrip(t *testing.T) {
 		t.Fatalf("NewManager: %v", err)
 	}
 
-	deviceID := "0123456789abcdef0123456789abcdef"
-	signed, err := m.Issue(deviceID)
+	signed, err := m.Issue(testUserID, testDeviceID)
 	if err != nil {
 		t.Fatalf("Issue: %v", err)
 	}
@@ -21,18 +28,33 @@ func TestIssueVerifyRoundtrip(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Verify: %v", err)
 	}
-	if got != deviceID {
-		t.Fatalf("Verify: got %q want %q", got, deviceID)
+	if got.UserID != testUserID {
+		t.Errorf("Verify.UserID = %q, want %q", got.UserID, testUserID)
+	}
+	if got.DeviceID != testDeviceID {
+		t.Errorf("Verify.DeviceID = %q, want %q", got.DeviceID, testDeviceID)
+	}
+}
+
+func TestIssueIsUserSubject(t *testing.T) {
+	m, _ := NewManager("test-secret")
+	signed, err := m.Issue(testUserID, testDeviceID)
+	if err != nil {
+		t.Fatalf("Issue: %v", err)
+	}
+	parsed, err := paseto.NewParserForValidNow().ParseV4Local(m.key, signed, nil)
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if subject, _ := parsed.GetSubject(); subject != testUserID {
+		t.Errorf("subject = %q, want user %q", subject, testUserID)
 	}
 }
 
 func TestVerifyRejectsTamperedToken(t *testing.T) {
-	m, err := NewManager("test-secret")
-	if err != nil {
-		t.Fatalf("NewManager: %v", err)
-	}
+	m, _ := NewManager("test-secret")
 
-	signed, _ := m.Issue("0123456789abcdef0123456789abcdef")
+	signed, _ := m.Issue(testUserID, testDeviceID)
 	parts := strings.Split(signed, ".")
 	parts[len(parts)-1] = "nope"
 	tampered := strings.Join(parts, ".")
@@ -43,10 +65,7 @@ func TestVerifyRejectsTamperedToken(t *testing.T) {
 }
 
 func TestVerifyRejectsGarbage(t *testing.T) {
-	m, err := NewManager("test-secret")
-	if err != nil {
-		t.Fatalf("NewManager: %v", err)
-	}
+	m, _ := NewManager("test-secret")
 	if _, err := m.Verify("not-a-token"); err == nil {
 		t.Fatal("expected garbage to be rejected")
 	}
@@ -56,8 +75,23 @@ func TestDifferentSecretRejectsToken(t *testing.T) {
 	a, _ := NewManager("secret-a")
 	b, _ := NewManager("secret-b")
 
-	signed, _ := a.Issue("0123456789abcdef0123456789abcdef")
+	signed, _ := a.Issue(testUserID, testDeviceID)
 	if _, err := b.Verify(signed); err == nil {
 		t.Fatal("expected token from another manager to be rejected")
 	}
 }
+
+func TestVerifyRequiresDeviceClaim(t *testing.T) {
+	m, _ := NewManager("test-secret")
+	// Token sans claim device_id (subject seul, type de l'ancien format) → invalide.
+	now := time.Now()
+	token := paseto.NewToken()
+	token.SetIssuedAt(now)
+	token.SetNotBefore(now)
+	token.SetExpiration(now.Add(TokenTTL))
+	token.SetSubject(testUserID)
+	signed := token.V4Encrypt(m.key, nil)
+	if _, err := m.Verify(signed); err == nil {
+		t.Fatal("expected token without device claim to be rejected")
+	}
+}