auth: Sprint 02 — auth hardening (Pydantic models, challenge binding, admin gates)

- Add max_length validation to LoginRequest (username 128, password 1024)
- Replace raw request.json() with Pydantic models in RBAC override/update endpoints
- Replace raw request.json() with Pydantic models in passkey register/login/delete
- Bind passkey challenges to session-bound challenge_id (prevents cross-session replay)
- Gate audit log and security log endpoints behind admin role
- Fix fragile opc_db.json.dumps() → import json directly
- Add COOKIE_SECURE=False startup warning (suppress with ALLOW_INSECURE_COOKIES)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

dashboard/backend/tests/integration/test_auth_flow.py

@@ -362,8 +362,7 @@ class TestRBACConfig:
         """Test setting user override without pages field."""
         response = test_app.put("/api/auth/rbac/overrides/testuser", headers=admin_headers, json={})
 
-        assert response.status_code == 400
-        assert "Missing pages field" in response.json()["detail"]
+        assert response.status_code == 422
 
     def test_set_user_override_as_member(self, test_app, mock_config, temp_auth_file, temp_rbac_file):
         """Test that non-admin cannot set user override."""
@@ -437,8 +436,7 @@ class TestRBACConfig:
             "/api/auth/rbac/roles/member", headers=admin_headers, json={"sidebar_links": ["navidrome"]}
         )
 
-        assert response.status_code == 400
-        assert "Missing pages field" in response.json()["detail"]
+        assert response.status_code == 422
 
     def test_update_role_config_invalid_pages_type(
         self, test_app, mock_config, temp_auth_file, temp_rbac_file, admin_headers