feat(api): JWT 单用户认证（auth.py）+ config 扩展

tests/api/test_auth.py

@@ -0,0 +1,24 @@
+# tests/api/test_auth.py
+import pytest
+
+def test_create_and_verify_token():
+    from sanguo_api.auth import create_token, verify_token, set_jwt_config
+    set_jwt_config(secret="test_secret", expire_minutes=60)
+    token = create_token("admin")
+    assert isinstance(token, str)
+    assert verify_token(token) == "admin"
+
+def test_verify_token_invalid_raises_401():
+    from fastapi import HTTPException
+    from sanguo_api.auth import verify_token, set_jwt_config
+    set_jwt_config(secret="test_secret", expire_minutes=60)
+    with pytest.raises(HTTPException) as exc:
+        verify_token("invalid.token.here")
+    assert exc.value.status_code == 401
+
+def test_hash_and_verify_password():
+    from sanguo_api.auth import hash_password, verify_password
+    h = hash_password("mypass")
+    assert h != "mypass"
+    assert verify_password("mypass", h) is True
+    assert verify_password("wrong", h) is False