M1: Password complexity validation (min 8 chars, uppercase, lowercase, digit)
M2: Remove is_system_admin from login response (prevent role leaking)
M3: Permission cache invalidates on DB error instead of using stale data
M4: .env.docker.example already fixed in B9 (SECRET_KEY, FRONTEND_URL, SMTP)
M6: Frontend test setup auto-wraps with QueryClientProvider (fixes ~29 test failures)
Remaining: M5 (frontend component integration — WelcomeDialog, SavedFilterBar, etc.)
- Remove duplicate vi.mock(@/api/hooks) in SettingsRoles.test.tsx that overrode forceUpdate logic
- SettingsRoles mock: use vi.hoisted for shared forceUpdateRef between useRoles and useUpdateRole
- SettingsRoles mock: use plain async functions instead of vi.fn().mockImplementation for mutations