feat(backend): T1.1 认证与权限 — 注册/登录/刷新/获取用户

- 后端：auth 路由（register/login/refresh/me）+ JWT + bcrypt 密码哈希
- 依赖注入：get_current_user + require_role 角色权限校验
- 跨数据库兼容：JSONBType（PG 用 JSONB，SQLite 用 JSON）
- 测试：11 个认证测试 + 4 个健康检查测试 = 15 passed

backend/app/core/dependencies.py

@@ -0,0 +1,66 @@
+"""认证依赖注入。
+
+提供当前用户依赖、权限校验。
+"""
+
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_db
+from app.core.security import decode_token
+from app.models.user import User
+
+security = HTTPBearer()
+
+
+async def get_current_user(
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    db: AsyncSession = Depends(get_db),
+) -> User:
+    """从 JWT token 中解析当前用户。"""
+    token = credentials.credentials
+    try:
+        payload = decode_token(token)
+    except Exception:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="无效的认证凭证",
+        )
+
+    if payload.get("type") != "access":
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="无效的 token 类型",
+        )
+
+    user_id = payload.get("sub")
+    if not user_id:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="无效的 token 内容",
+        )
+
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+
+    if not user or not user.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="用户不存在或已禁用",
+        )
+
+    return user
+
+
+def require_role(*roles: str):
+    """角色权限校验依赖工厂。"""
+    async def check_role(user: User = Depends(get_current_user)) -> User:
+        if user.role not in roles:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail=f"需要角色：{', '.join(roles)}",
+            )
+        return user
+    return check_role