feat(T01): auth + user management + RBAC + base frontend + i18n

- Backend: FastAPI, JWT auth (HS256), bcrypt, RBAC middleware
- User CRUD (admin-only), soft-delete, pagination
- Pydantic BaseSettings config, async SQLAlchemy 2.0
- 50 backend tests, 88% coverage
- Frontend: Next.js 14 App Router, Tailwind, design tokens
- Login page, auth context, API client with auto-refresh
- i18n: next-intl, DE/EN (31 keys each)
- 6 base UI components (Button, Input, Card, Table, Modal, Toast)
- 12 frontend tests, npm build success

backend/tests/test_users.py

@@ -0,0 +1,169 @@
+"""Tests for users endpoints: list, create, update, delete (admin only)."""
+
+import uuid
+
+import pytest
+from httpx import AsyncClient
+
+from app.models.user import User
+
+
+@pytest.mark.asyncio
+async def test_list_users_as_admin(admin_client: AsyncClient, admin_user: User):
+    """GET /api/v1/users as admin returns 200 + paginated list."""
+    response = await admin_client.get("/api/v1/users/")
+    assert response.status_code == 200
+    data = response.json()
+    assert "items" in data
+    assert "total" in data
+    assert "page" in data
+    assert "page_size" in data
+    assert data["total"] >= 1
+    assert data["page"] == 1
+    assert data["page_size"] == 20
+
+
+@pytest.mark.asyncio
+async def test_list_users_as_non_admin(verkaeufer_client: AsyncClient):
+    """GET /api/v1/users as verkaeufer returns 403."""
+    response = await verkaeufer_client.get("/api/v1/users/")
+    assert response.status_code == 403
+    data = response.json()
+    assert "error" in data["detail"]
+
+
+@pytest.mark.asyncio
+async def test_list_users_without_auth(client: AsyncClient):
+    """GET /api/v1/users without token returns 401."""
+    response = await client.get("/api/v1/users/")
+    assert response.status_code == 401
+
+
+@pytest.mark.asyncio
+async def test_list_users_pagination(admin_client: AsyncClient, admin_user: User):
+    """GET /api/v1/users?page=1&page_size=5 returns correct pagination."""
+    response = await admin_client.get("/api/v1/users/?page=1&page_size=5")
+    assert response.status_code == 200
+    data = response.json()
+    assert data["page"] == 1
+    assert data["page_size"] == 5
+    assert len(data["items"]) <= 5
+
+
+@pytest.mark.asyncio
+async def test_create_user_as_admin(admin_client: AsyncClient):
+    """POST /api/v1/users as admin creates a new user, returns 201."""
+    response = await admin_client.post("/api/v1/users/", json={
+        "email": "newuser@test.com",
+        "password": "NewUser123!",
+        "full_name": "New User",
+        "role": "verkaeufer",
+        "language": "de",
+    })
+    assert response.status_code == 201
+    data = response.json()
+    assert data["email"] == "newuser@test.com"
+    assert data["full_name"] == "New User"
+    assert data["role"] == "verkaeufer"
+    assert data["is_active"] is True
+    assert "password_hash" not in data
+    assert "password" not in data
+
+
+@pytest.mark.asyncio
+async def test_create_user_as_non_admin(verkaeufer_client: AsyncClient):
+    """POST /api/v1/users as verkaeufer returns 403."""
+    response = await verkaeufer_client.post("/api/v1/users/", json={
+        "email": "forbidden@test.com",
+        "password": "Forbidden123!",
+        "full_name": "Forbidden",
+        "role": "admin",
+        "language": "de",
+    })
+    assert response.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_create_user_duplicate_email(admin_client: AsyncClient, admin_user: User):
+    """POST /api/v1/users with existing email returns 409."""
+    response = await admin_client.post("/api/v1/users/", json={
+        "email": "admin@test.com",
+        "password": "SomePassword123!",
+        "full_name": "Duplicate",
+        "role": "verkaeufer",
+        "language": "de",
+    })
+    assert response.status_code == 409
+
+
+@pytest.mark.asyncio
+async def test_create_user_short_password(admin_client: AsyncClient):
+    """POST /api/v1/users with password < 8 chars returns 422."""
+    response = await admin_client.post("/api/v1/users/", json={
+        "email": "shortpw@test.com",
+        "password": "short",
+        "full_name": "Short PW",
+        "role": "verkaeufer",
+        "language": "de",
+    })
+    assert response.status_code == 422
+
+
+@pytest.mark.asyncio
+async def test_update_user_as_admin(admin_client: AsyncClient, admin_user: User, verkaeufer_user: User):
+    """PUT /api/v1/users/:id as admin updates user fields, returns 200."""
+    response = await admin_client.put(
+        f"/api/v1/users/{verkaeufer_user.id}",
+        json={"full_name": "Updated Name", "language": "de"},
+    )
+    assert response.status_code == 200
+    data = response.json()
+    assert data["full_name"] == "Updated Name"
+    assert data["language"] == "de"
+
+
+@pytest.mark.asyncio
+async def test_update_user_nonexistent(admin_client: AsyncClient):
+    """PUT /api/v1/users/:id with unknown id returns 404."""
+    fake_id = uuid.uuid4()
+    response = await admin_client.put(
+        f"/api/v1/users/{fake_id}",
+        json={"full_name": "Nobody"},
+    )
+    assert response.status_code == 404
+
+
+@pytest.mark.asyncio
+async def test_delete_user_soft_deactivate(admin_client: AsyncClient, verkaeufer_user: User):
+    """DELETE /api/v1/users/:id soft-deletes (is_active=false), returns 200."""
+    response = await admin_client.delete(f"/api/v1/users/{verkaeufer_user.id}")
+    assert response.status_code == 200
+    data = response.json()
+    assert data["is_active"] is False
+    assert data["id"] == str(verkaeufer_user.id)
+
+
+@pytest.mark.asyncio
+async def test_delete_user_nonexistent(admin_client: AsyncClient):
+    """DELETE /api/v1/users/:id with unknown id returns 404."""
+    fake_id = uuid.uuid4()
+    response = await admin_client.delete(f"/api/v1/users/{fake_id}")
+    assert response.status_code == 404
+
+
+@pytest.mark.asyncio
+async def test_delete_user_as_non_admin(verkaeufer_client: AsyncClient, admin_user: User):
+    """DELETE /api/v1/users/:id as verkaeufer returns 403."""
+    response = await verkaeufer_client.delete(f"/api/v1/users/{admin_user.id}")
+    assert response.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_user_response_excludes_password_hash(admin_client: AsyncClient, admin_user: User):
+    """User response never includes password_hash or password fields."""
+    response = await admin_client.get("/api/v1/users/")
+    assert response.status_code == 200
+    data = response.json()
+    for item in data["items"]:
+        assert "password_hash" not in item
+        assert "password" not in item