feat: add session auth api

backend/apps/accounts/tests/test_auth_api.py

@@ -0,0 +1,37 @@
+from django.contrib.auth import get_user_model
+from django.core.management import call_command
+
+
+def test_login_me_and_logout_flow(client, db):
+    call_command("bootstrap_governance")
+
+    login = client.post(
+        "/api/accounts/auth/login",
+        data={"username": "admin", "password": "admin12345"},
+        content_type="application/json",
+    )
+    assert login.status_code == 200
+    assert login.json()["username"] == "admin"
+
+    me = client.get("/api/accounts/auth/me")
+    assert me.status_code == 200
+    payload = me.json()
+    assert payload["username"] == "admin"
+    assert "system.user.manage" in payload["permissions"]
+    assert any(menu["code"] == "system" for menu in payload["menus"])
+
+    logout = client.post("/api/accounts/auth/logout")
+    assert logout.status_code == 200
+    assert client.get("/api/accounts/auth/me").status_code == 401
+
+
+def test_login_rejects_invalid_password(client, db):
+    get_user_model().objects.create_user(username="u", password="right")
+
+    response = client.post(
+        "/api/accounts/auth/login",
+        data={"username": "u", "password": "wrong"},
+        content_type="application/json",
+    )
+
+    assert response.status_code == 401