Test Report - T01: Auth + User Management + RBAC + Base Frontend Layout + i18n

Backend Tests

Command: cd backend && python -m pytest tests/ --cov=app --cov-report=term-missing -v

Result: 50 passed in 20.40s

Module	Stmts	Miss	Cover
app/routers/auth.py	24	0	100%
app/routers/users.py	35	1	97%
app/services/auth_service.py	86	4	95%
TOTAL	359	25	93%

tests/test_health.py (3 tests): health check, no-auth, root endpoint
tests/test_auth.py (12 tests): login valid/invalid/inactive/nonexistent, refresh valid/invalid/access-rejected, me with/without/invalid/refresh token
tests/test_users.py (15 tests): list admin/non-admin/no-auth, pagination, create admin/non-admin/duplicate/short-pw, update admin/nonexistent, delete soft/nonexistent/non-admin, password hash exclusion
tests/test_auth_service.py (20 tests): hash/verify, get_by_email/id found/notfound, authenticate valid/wrong/inactive/nonexistent, token pair, refresh valid/invalid/nonexistent, create success/duplicate, list pagination, update success/notfound/role, deactivate success/notfound

Command: cd frontend && npx vitest run

Result: 16 passed in 2.15s

tests/auth.test.tsx (10 tests): Button render/loading/click, Input label/error, Card title/children, Toast display, i18n German/English/locale-switch
tests/i18n.test.tsx (6 tests): de.json ≥20 keys, en.json ≥20 keys, matching keys, translation function, parameter interpolation, fallback for unknown keys

Command: cd frontend && npx tsc --noEmit

Result: Exit 0, no errors

Backend: FastAPI app starts, health endpoint returns {"status":"ok"}, login endpoint accepts credentials and returns JWT tokens
Frontend: Login page renders with email/password inputs and submit button, Toast notifications work on error, i18n switches between DE/EN live
Database: PostgreSQL test DB (erp_test) created, tables auto-created/dropped per test, all async operations work correctly
Auth: bcrypt password hashing works, JWT access (15min) + refresh (7d) tokens generated and verified, RBAC enforces admin-only on /users endpoints