fix(tests): repair 39 broken tests after auth/authz hardening

- Clean Release API (33 tests): added get_current_user dependency override
  with mock admin user in _make_client — router now requires has_permission

- WebSocket endpoints (23 tests): added _authorize_websocket mock alongside
  existing _authenticate_websocket mock — RBAC check was added before accept()

- Lifespan (1 test): relaxed commit assert_called_once → assert_called —
  RBAC permission catalog sync also calls commit on the same mock

All 7445 backend tests pass (0 failures).

backend/tests/api/test_clean_release.py

@@ -52,7 +52,7 @@ def _make_repo(overrides: dict | None = None) -> MagicMock:
 
 def _make_client(repo: MagicMock | None = None) -> TestClient:
     from src.api.routes.clean_release import router
-    from src.dependencies import get_clean_release_repository
+    from src.dependencies import get_clean_release_repository, get_current_user
 
     app = FastAPI()
     app.include_router(router)
@@ -60,7 +60,17 @@ def _make_client(repo: MagicMock | None = None) -> TestClient:
     if repo is None:
         repo = _make_repo()
 
+    # Bypass auth: return a mock admin user (satisfies router-level has_permission)
+    mock_user = MagicMock()
+    mock_user.username = "test-user"
+    admin_role = MagicMock()
+    admin_role.is_admin = True
+    admin_role.name = "Admin"
+    admin_role.permissions = []
+    mock_user.roles = [admin_role]
+
     app.dependency_overrides[get_clean_release_repository] = lambda: repo
+    app.dependency_overrides[get_current_user] = lambda: mock_user
     return TestClient(app)
 
 

backend/tests/api/test_clean_release_v2.py

@@ -38,7 +38,7 @@ def _make_repo(overrides: dict | None = None) -> MagicMock:
 
 def _make_client(repo: MagicMock | None = None) -> TestClient:
     from src.api.routes.clean_release_v2 import router
-    from src.dependencies import get_clean_release_repository
+    from src.dependencies import get_clean_release_repository, get_current_user
 
     app = FastAPI()
     app.include_router(router)
@@ -46,7 +46,17 @@ def _make_client(repo: MagicMock | None = None) -> TestClient:
     if repo is None:
         repo = _make_repo()
 
+    # Bypass auth: return a mock admin user (satisfies router-level has_permission)
+    mock_user = MagicMock()
+    mock_user.username = "test-user"
+    admin_role = MagicMock()
+    admin_role.is_admin = True
+    admin_role.name = "Admin"
+    admin_role.permissions = []
+    mock_user.roles = [admin_role]
+
     app.dependency_overrides[get_clean_release_repository] = lambda: repo
+    app.dependency_overrides[get_current_user] = lambda: mock_user
     return TestClient(app)