fix(auth): api_key condivisa fra postazioni, timing costante al login (#25)

login_user riusa l'api_key esistente invece di rigenerarla ad ogni
login: due postazioni collegate con lo stesso utente restavano
altrimenti disconnesse a vicenda. logout_user diventa no-op sulla key
a meno di all_sessions=True (nuovo parametro, passato da
POST /api/auth/logout?all_sessions=true nel router).

authenticate_user esegue comunque bcrypt.checkpw contro un hash fittizio
quando lo username non esiste, per non rivelare col tempo di risposta
se uno username è registrato.

PUT /api/users/{id}/password azzera l'api_key dell'utente dopo il
cambio, come già fa setup.py:634.

Non introdotto in questa issue: hashing o scadenza della api_key
(annotato come MANCA nel rapporto del lotto).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/backend/tests/test_auth.py

@@ -78,6 +78,97 @@ class TestLogin:
         assert len(api_key) >= 32
 
 
+class TestLoginKeyReuse:
+    """login_user reuses an existing api_key instead of rotating it (#25)."""
+
+    async def test_two_logins_same_user_share_api_key(
+        self, client: AsyncClient, db_session
+    ):
+        """Two stations logging in as the same shift account both keep working."""
+        await _create_user(db_session, username="twostations", password="TwoStations1")
+        resp1 = await client.post(
+            "/api/auth/login",
+            json={"username": "twostations", "password": "TwoStations1"},
+        )
+        resp2 = await client.post(
+            "/api/auth/login",
+            json={"username": "twostations", "password": "TwoStations1"},
+        )
+        assert resp1.status_code == 200
+        assert resp2.status_code == 200
+        assert resp1.json()["api_key"] == resp2.json()["api_key"]
+
+    async def test_login_generates_key_when_user_has_none(
+        self, client: AsyncClient, db_session
+    ):
+        """A user created without an api_key (e.g. via create_user) still gets one."""
+        from src.backend.services.auth_service import create_user
+
+        await create_user(
+            db_session, username="brandnew", password="BrandNew1",
+            display_name="Brand New",
+        )
+        resp = await client.post(
+            "/api/auth/login",
+            json={"username": "brandnew", "password": "BrandNew1"},
+        )
+        assert resp.status_code == 200
+        assert resp.json()["api_key"]
+
+
+class TestLogout:
+    """POST /api/auth/logout is a no-op on the shared api_key by default (#25)."""
+
+    async def test_logout_default_keeps_api_key_valid(
+        self, client: AsyncClient, db_session
+    ):
+        user = await _create_user(
+            db_session, username="shared_logout", password="SharedPass1"
+        )
+        headers = auth_headers(user)
+        resp = await client.post("/api/auth/logout", headers=headers)
+        assert resp.status_code == 204
+
+        # The key is still valid: another station on the same account keeps working.
+        resp = await client.get("/api/auth/me", headers=headers)
+        assert resp.status_code == 200
+
+    async def test_logout_all_sessions_invalidates_api_key(
+        self, client: AsyncClient, db_session
+    ):
+        user = await _create_user(
+            db_session, username="shared_logout_all", password="SharedPass1"
+        )
+        headers = auth_headers(user)
+        resp = await client.post(
+            "/api/auth/logout", params={"all_sessions": "true"}, headers=headers
+        )
+        assert resp.status_code == 204
+
+        resp = await client.get("/api/auth/me", headers=headers)
+        assert resp.status_code == 401
+
+
+class TestAuthenticateUserTiming:
+    """authenticate_user pays the bcrypt cost even for an unknown username (#25)."""
+
+    async def test_unknown_username_still_returns_none(self, db_session):
+        from src.backend.services.auth_service import authenticate_user
+
+        result = await authenticate_user(db_session, "no-such-user-at-all", "whatever")
+        assert result is None
+
+    def test_dummy_hash_is_a_valid_bcrypt_hash(self):
+        from src.backend.services.auth_service import (
+            _DUMMY_PASSWORD_HASH,
+            verify_password,
+        )
+
+        assert verify_password(
+            "tiemeasureflow-dummy-hash-for-timing", _DUMMY_PASSWORD_HASH
+        )
+
+
 class TestHealthAndAuth:
     """Health check and auth requirement tests."""