feat(auth): AuthSessionController — POST /api/auth/login + /api/auth/logout with Spring Session JDBC

- Expose AuthenticationManager bean in SecurityConfig
- Permit /api/auth/login; return 401 (not 302) for unauthenticated requests
- Remove httpBasic and formLogin from SecurityConfig

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/test/java/org/raddatz/familienarchiv/auth/AuthServiceTest.java

@@ -115,15 +115,18 @@ class AuthServiceTest {
     @Test
     void logout_fires_LOGOUT_audit() {
         UUID userId = UUID.randomUUID();
+        AppUser user = AppUser.builder().id(userId).email("user@test.de").build();
+        when(userService.findByEmail("user@test.de")).thenReturn(user);
 
-        authService.logout(userId, IP, UA);
+        authService.logout("user@test.de", IP, UA);
 
         verify(auditService).log(
             eq(AuditKind.LOGOUT),
             eq(userId),
             isNull(),
             argThat(payload -> userId.toString().equals(payload.get("userId").toString())
-                && IP.equals(payload.get("ip")))
+                && IP.equals(payload.get("ip"))
+                && !payload.containsKey("password"))
         );
     }
 }

backend/src/test/java/org/raddatz/familienarchiv/auth/AuthSessionControllerTest.java

@@ -0,0 +1,111 @@
+package org.raddatz.familienarchiv.auth;
+
+import org.junit.jupiter.api.Test;
+import org.raddatz.familienarchiv.auth.AuthService.LoginResult;
+import org.raddatz.familienarchiv.exception.DomainException;
+import org.raddatz.familienarchiv.exception.ErrorCode;
+import org.raddatz.familienarchiv.security.SecurityConfig;
+import org.raddatz.familienarchiv.security.PermissionAspect;
+import org.raddatz.familienarchiv.user.AppUser;
+import org.raddatz.familienarchiv.user.CustomUserDetailsService;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.aop.AopAutoConfiguration;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
+import org.springframework.context.annotation.Import;
+import org.springframework.http.MediaType;
+import org.springframework.security.core.Authentication;
+import org.springframework.test.context.bean.override.mockito.MockitoBean;
+import org.springframework.test.web.servlet.MockMvc;
+
+import java.util.UUID;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.*;
+import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
+
+@WebMvcTest(AuthSessionController.class)
+@Import({SecurityConfig.class, PermissionAspect.class, AopAutoConfiguration.class})
+class AuthSessionControllerTest {
+
+    @Autowired MockMvc mockMvc;
+
+    @MockitoBean AuthService authService;
+    @MockitoBean CustomUserDetailsService customUserDetailsService;
+
+    // ─── POST /api/auth/login ──────────────────────────────────────────────────
+
+    @Test
+    void login_returns_200_with_user_on_valid_credentials() throws Exception {
+        UUID userId = UUID.randomUUID();
+        AppUser appUser = AppUser.builder().id(userId).email("user@test.de").build();
+        Authentication auth = mock(Authentication.class);
+        when(authService.login(anyString(), anyString(), anyString(), anyString()))
+            .thenReturn(new LoginResult(appUser, auth));
+
+        mockMvc.perform(post("/api/auth/login")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"email\":\"user@test.de\",\"password\":\"pass123\"}"))
+            .andExpect(status().isOk())
+            .andExpect(jsonPath("$.email").value("user@test.de"))
+            .andExpect(jsonPath("$.id").value(userId.toString()));
+    }
+
+    @Test
+    void login_returns_401_with_INVALID_CREDENTIALS_on_bad_credentials() throws Exception {
+        when(authService.login(anyString(), anyString(), anyString(), anyString()))
+            .thenThrow(DomainException.invalidCredentials());
+
+        mockMvc.perform(post("/api/auth/login")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"email\":\"user@test.de\",\"password\":\"wrong\"}"))
+            .andExpect(status().isUnauthorized())
+            .andExpect(jsonPath("$.code").value(ErrorCode.INVALID_CREDENTIALS.name()));
+    }
+
+    @Test
+    void login_is_public_no_session_required() throws Exception {
+        UUID userId = UUID.randomUUID();
+        AppUser appUser = AppUser.builder().id(userId).email("pub@test.de").build();
+        Authentication auth = mock(Authentication.class);
+        when(authService.login(anyString(), anyString(), anyString(), anyString()))
+            .thenReturn(new LoginResult(appUser, auth));
+
+        // No WithMockUser — must be reachable without an active session
+        mockMvc.perform(post("/api/auth/login")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"email\":\"pub@test.de\",\"password\":\"pass\"}"))
+            .andExpect(status().isOk());
+    }
+
+    @Test
+    void login_does_not_set_cookie_on_failure() throws Exception {
+        when(authService.login(anyString(), anyString(), anyString(), anyString()))
+            .thenThrow(DomainException.invalidCredentials());
+
+        mockMvc.perform(post("/api/auth/login")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content("{\"email\":\"user@test.de\",\"password\":\"wrong\"}"))
+            .andExpect(status().isUnauthorized())
+            .andExpect(header().doesNotExist("Set-Cookie"));
+    }
+
+    // ─── POST /api/auth/logout ─────────────────────────────────────────────────
+
+    @Test
+    void logout_returns_204_when_authenticated() throws Exception {
+        doNothing().when(authService).logout(anyString(), anyString(), anyString());
+
+        mockMvc.perform(post("/api/auth/logout")
+                .with(user("user@test.de")))
+            .andExpect(status().isNoContent());
+    }
+
+    @Test
+    void logout_returns_401_when_not_authenticated() throws Exception {
+        // No authentication at all — Spring Security must return 401
+        mockMvc.perform(post("/api/auth/logout"))
+            .andExpect(status().isUnauthorized());
+    }
+}