feat(auth): implement user and device authentication

backend-api/internal/repository/sqlite/store_test.go

@@ -321,6 +321,18 @@ func TestStoreEnforcesAssetOwnershipSourceReferenceAndStableCursor(
 func openStore(t *testing.T) *repository.Store {
 	t.Helper()
 	db := openDatabase(t)
+	now := time.Now().UTC().Format(time.RFC3339Nano)
+	if _, err := db.ExecContext(
+		context.Background(),
+		`INSERT INTO users (
+			id, username, password_hash, role, is_active, created_at, updated_at
+		) VALUES (?, 'task-audit-admin', 'test-only-hash', 'ADMIN', 1, ?, ?)`,
+		uuid(999),
+		now,
+		now,
+	); err != nil {
+		t.Fatalf("seed admin user: %v", err)
+	}
 	store, err := repository.New(db)
 	if err != nil {
 		t.Fatalf("repository.New() error = %v", err)
@@ -368,21 +380,23 @@ func testTask(
 	createdAt time.Time,
 ) domain.PurchaseTask {
 	budget := int64(2000 + index)
+	actorUserID := uuid(999)
 	return domain.PurchaseTask{
-		ID:             uuid(index),
-		CreatorSubject: "local-admin",
-		SourceRef:      &source,
-		Title:          "title " + string(rune('0'+index)),
-		Description:    "description",
-		SKU:            "SKU-" + string(rune('0'+index)),
-		ImageAssetID:   assetID,
-		Quantity:       index,
-		MaxBudgetCents: &budget,
-		Currency:       domain.CurrencyCNY,
-		Status:         domain.TaskStatusPending,
-		Version:        1,
-		CreatedAt:      createdAt,
-		UpdatedAt:      createdAt,
+		ID:              uuid(index),
+		CreatorSubject:  "local-admin",
+		CreatedByUserID: &actorUserID,
+		SourceRef:       &source,
+		Title:           "title " + string(rune('0'+index)),
+		Description:     "description",
+		SKU:             "SKU-" + string(rune('0'+index)),
+		ImageAssetID:    assetID,
+		Quantity:        index,
+		MaxBudgetCents:  &budget,
+		Currency:        domain.CurrencyCNY,
+		Status:          domain.TaskStatusPending,
+		Version:         1,
+		CreatedAt:       createdAt,
+		UpdatedAt:       createdAt,
 	}
 }