feat: add comprehensive unit and integration testing infrastructure

- Backend: pytest with unit tests (auth, rbac, config) and integration tests (auth flow, docker, files)
- Frontend: vitest with unit tests (api client) and component tests (login)
- CI: Gitea Actions workflow for automated testing with coverage reports
- Documentation: TESTING.md guide with setup, usage, and best practices
- Coverage goals: 80%+ backend, 70%+ frontend

dashboard/backend/tests/conftest.py

@@ -0,0 +1,192 @@
+"""
+Shared pytest fixtures for backend tests.
+"""
+import os
+import json
+import pytest
+from datetime import timedelta
+from fastapi.testclient import TestClient
+from unittest.mock import Mock, AsyncMock, patch
+
+
+@pytest.fixture
+def temp_volume_root(tmp_path):
+    """Create temporary volume root for testing."""
+    volume_root = tmp_path / "volume1"
+    volume_root.mkdir()
+    (volume_root / "docker" / "nas-dashboard").mkdir(parents=True)
+    return str(volume_root)
+
+
+@pytest.fixture
+def mock_config(temp_volume_root, monkeypatch):
+    """Mock config module with test values."""
+    monkeypatch.setenv("SECRET_KEY", "test-secret-key-at-least-32-chars-long")
+    monkeypatch.setenv("ADMIN_USER", "testadmin")
+    monkeypatch.setenv("ADMIN_PASSWORD_HASH", "$pbkdf2-sha256$29000$N2YMIQQgBAAgxBgjhPD.vw$1234567890abcdef")
+    monkeypatch.setenv("VOLUME_ROOT", temp_volume_root)
+    monkeypatch.setenv("DOCKER_HOST", "tcp://mock-docker:2375")
+    monkeypatch.setenv("GITEA_URL", "http://mock-gitea:3000")
+    monkeypatch.setenv("GITEA_TOKEN", "mock-token")
+
+    # Reload config module to pick up new env vars
+    import config
+    import importlib
+    importlib.reload(config)
+
+    return config
+
+
+@pytest.fixture
+def temp_auth_file(temp_volume_root):
+    """Create temporary auth.json file."""
+    auth_file = os.path.join(temp_volume_root, "docker/nas-dashboard/auth.json")
+    data = {
+        "totp_secret": "",
+        "passkey_credentials": [],
+        "token_version": 0,
+        "last_totp_ts": 0
+    }
+    with open(auth_file, "w") as f:
+        json.dump(data, f)
+    return auth_file
+
+
+@pytest.fixture
+def temp_rbac_file(temp_volume_root):
+    """Create temporary rbac.json file."""
+    rbac_file = os.path.join(temp_volume_root, "docker/nas-dashboard/rbac.json")
+    data = {
+        "role_defaults": {
+            "admin": {"pages": "*", "sidebar_links": "*"},
+            "member": {"pages": ["dashboard", "docker"], "sidebar_links": "*"},
+            "viewer": {"pages": ["dashboard"], "sidebar_links": ["dashboard"]}
+        },
+        "user_overrides": {}
+    }
+    with open(rbac_file, "w") as f:
+        json.dump(data, f)
+    return rbac_file
+
+
+@pytest.fixture
+def valid_access_token(mock_config):
+    """Generate a valid access token for testing."""
+    from auth import create_access_token
+    return create_access_token(
+        data={"sub": "testuser", "role": "admin"},
+        expires_delta=timedelta(minutes=30)
+    )
+
+
+@pytest.fixture
+def valid_refresh_token(mock_config, temp_auth_file):
+    """Generate a valid refresh token for testing."""
+    from auth import create_refresh_token
+    return create_refresh_token(data={"sub": "testuser", "role": "admin"})
+
+
+@pytest.fixture
+def expired_access_token(mock_config):
+    """Generate an expired access token for testing."""
+    from auth import create_access_token
+    return create_access_token(
+        data={"sub": "testuser", "role": "admin"},
+        expires_delta=timedelta(seconds=-1)
+    )
+
+
+@pytest.fixture
+def mock_docker_client():
+    """Mock Docker client for testing."""
+    client = Mock()
+
+    # Mock container
+    container = Mock()
+    container.id = "abc123"
+    container.name = "test-container"
+    container.status = "running"
+    container.attrs = {
+        "State": {"Health": {"Status": "healthy"}},
+        "Config": {"Image": "test-image:latest"}
+    }
+    container.logs.return_value = b"test log line 1\ntest log line 2\n"
+
+    client.containers.list.return_value = [container]
+    client.containers.get.return_value = container
+
+    return client
+
+
+@pytest.fixture
+def mock_ssh_connection():
+    """Mock asyncssh connection for testing."""
+    conn = AsyncMock()
+    process = AsyncMock()
+    process.stdout = AsyncMock()
+    process.stdin = AsyncMock()
+    process.stderr = AsyncMock()
+    conn.create_process.return_value = process
+    return conn
+
+
+@pytest.fixture
+def mock_httpx_client():
+    """Mock httpx AsyncClient for testing."""
+    client = AsyncMock()
+    response = AsyncMock()
+    response.status_code = 200
+    response.json.return_value = {"status": "ok"}
+    client.get.return_value = response
+    client.post.return_value = response
+    return client
+
+
+@pytest.fixture
+def test_app(mock_config, temp_auth_file, temp_rbac_file, mock_docker_client):
+    """Create FastAPI test client with mocked dependencies."""
+    # Patch Docker client before importing main
+    with patch("docker.DockerClient", return_value=mock_docker_client):
+        from main import app
+        client = TestClient(app)
+        yield client
+
+
+@pytest.fixture
+def admin_headers(valid_access_token):
+    """Headers with admin access token."""
+    return {"Authorization": f"Bearer {valid_access_token}"}
+
+
+@pytest.fixture
+def mock_rbac_data():
+    """Sample RBAC configuration for testing."""
+    return {
+        "role_defaults": {
+            "admin": {"pages": "*", "sidebar_links": "*"},
+            "member": {"pages": ["dashboard", "docker", "files"], "sidebar_links": "*"},
+            "viewer": {"pages": ["dashboard"], "sidebar_links": ["dashboard"]}
+        },
+        "user_overrides": {
+            "customuser": {
+                "pages": ["dashboard", "docker"],
+                "sidebar_links": ["dashboard", "docker", "files"]
+            }
+        }
+    }
+
+
+@pytest.fixture
+def sample_totp_secret():
+    """Sample TOTP secret for testing."""
+    return "JBSWY3DPEHPK3PXP"  # Base32 encoded secret
+
+
+@pytest.fixture
+def mock_request():
+    """Mock FastAPI Request object."""
+    request = Mock()
+    request.client = Mock()
+    request.client.host = "192.168.31.100"
+    request.headers = {}
+    return request