security: critical auth fixes, test migration to SQLite+FK, 44 test fixes

CRITICAL (CVE-class):
- C-4: Remove DEV_MODE fallback with hardcoded postgres:postgres credentials
- C-3: WebSocket endpoints now require JWT or API key token (?token=) auth
- C-1: Superset environment passwords encrypted via Fernet at rest in DB
- H-4: SESSION_SECRET_KEY separated from JWT AUTH_SECRET_KEY
- H-1: Log injection via %s-formatting instead of f-strings
- H-5: X-Trace-ID header validated as UUID4 to prevent trace poisoning

INFRASTRUCTURE:
- New src/core/encryption.py — EncryptionManager extracted from llm_provider
- Test DB: per-module sqlite:///:memory: with PRAGMA foreign_keys=ON
- testcontainers PostgreSQL via TEST_DB=postgres env var
- conftest temp-file global engine (no 10GB shared-cache leak)

TEST FIXES (44 pre-existing → 0):
- test_smoke_plugins: module-level sys.modules mock isolated to per-test fixture
- test_migration_engine: EXT:Python:uuid → uuid syntax fix
- test_dashboards_api: mock env attributes + correct patch target
- test_constants_audit_fixes: sync expected constant names with actual
- test_defensive_guards: patch.object instead of module-level Repo mock
- test_clean_release_cli: removed empty config.json directory
- FK violations: TaskRecord parents in log_persistence, Environment in
  mapping_service, ReleaseCandidate in candidate_manifest_services

ORTHOGONAL TESTS (18 new):
- test_security_orthogonal.py: bcrypt 72-byte limit, unicode, API key
  format invariants, Fernet robustness, encryption key lifecycle,
  log injection protection, JWT edge cases

MODEL FIXES:
- MetricSnapshot.job_id: nullable with SET NULL (was broken FK for
  aggregate prune snapshots, hidden by SQLite)

CLEANUP:
- Removed stale :memory:test_main/test_auth/test_tasks file databases
- Removed duplicate #endregion in encryption_key.py

backend/tests/core/test_defensive_guards.py

@@ -57,19 +57,18 @@ def test_superset_client_import_dashboard_guard():
 def test_git_service_init_repo_reclones_when_path_is_not_a_git_repo():
     """Verify init_repo reclones when target path exists but is not a valid Git repository."""
     service = GitService(base_path="test_repos_invalid_repo")
-    target_path = Path(service.base_path) / "covid"
+    target_dir = Path(service.base_path)
+    if target_dir.exists():
+        shutil.rmtree(target_dir, ignore_errors=True)
+    target_path = target_dir / "covid"
     target_path.mkdir(parents=True, exist_ok=True)
-    (target_path / "placeholder.txt").write_text("not a git repo", encoding="utf-8")
 
     clone_result = MagicMock()
-    with patch("src.services.git._base.Repo") as repo_ctor:
-        repo_ctor.side_effect = InvalidGitRepositoryError("invalid repo")
-        repo_ctor.clone_from.return_value = clone_result
+    with patch.object(service, "_clone_with_auth", return_value=clone_result) as mock_clone:
         result = service.init_repo(10, "https://example.com/org/repo.git", "token", repo_key="covid")
 
     assert result is clone_result
-    repo_ctor.assert_called_once_with(str(target_path))
-    repo_ctor.clone_from.assert_called_once()
+    mock_clone.assert_called_once()
     assert not target_path.exists()