fix: 认证审查修复（角色依赖连锁409门/停用租户token取舍注记/公共面整理）

Co-Authored-By: Claude Code <noreply@anthropic.com>

tests/test_auth.py

@@ -159,3 +159,37 @@ def test_tenant_admin_role_scoped():
     with pytest.raises(HTTPException) as ei2:
         dep(other)
     assert ei2.value.status_code == 403            # 它租户 403
+
+
+def test_role_dependencies_chain_must_change_409(app_client):
+    """审查修复 Issue 1: require_super/require_tenant 参数走 platform_user
+    (get_current_user + enforce 连锁)——must_change=True 的请求先撞 409 门,
+    Task 5 路由挂角色依赖时不可能静默漏挂。
+
+    连锁只在 FastAPI 依赖解析时生效(直调函数体只跑角色判断),故用
+    一次性探针 app 挂真实 DI 验证;token 经主 app 的真实 login/change-password
+    路由取放(同一进程级 TokenStore)。端点级覆盖仍在 Task 5。"""
+    from fastapi import Depends, FastAPI
+    from fastapi.testclient import TestClient
+
+    probe = FastAPI()
+
+    @probe.post("/probe-super")
+    async def _super(user=Depends(require_super)):
+        return {"user_id": user.user_id}
+
+    @probe.post("/probe-tenant")
+    async def _tenant(user=Depends(require_tenant("jiancai"))):
+        return {"user_id": user.user_id}
+
+    token = _login(app_client).json()["token"]   # 超管, must_change=True
+    with TestClient(probe) as c:
+        # 409 门先于角色判断
+        assert c.post("/probe-super", headers=_auth(token)).status_code == 409
+        assert c.post("/probe-tenant", headers=_auth(token)).status_code == 409
+        # 改密(标志就地清零)后放行到角色层: super 两个依赖都过
+        app_client.post(
+            CHANGE_PW, headers=_auth(token),
+            json={"old_password": "admin123", "new_password": "n3w-pass-9"})
+        assert c.post("/probe-super", headers=_auth(token)).status_code == 200
+        assert c.post("/probe-tenant", headers=_auth(token)).status_code == 200