feat: complete external auth V2 migration with advanced features

This commit implements comprehensive external Azure AD authentication
with complete task management, file download, and admin monitoring systems.

## Core Features Implemented (80% Complete)

### 1. Token Auto-Refresh Mechanism ✅
- Backend: POST /api/v2/auth/refresh endpoint
- Frontend: Auto-refresh 5 minutes before expiration
- Auto-retry on 401 errors with seamless token refresh

### 2. File Download System ✅
- Three format support: JSON / Markdown / PDF
- Endpoints: GET /api/v2/tasks/{id}/download/{format}
- File access control with ownership validation
- Frontend download buttons in TaskHistoryPage

### 3. Complete Task Management ✅
Backend Endpoints:
- POST /api/v2/tasks/{id}/start - Start task
- POST /api/v2/tasks/{id}/cancel - Cancel task
- POST /api/v2/tasks/{id}/retry - Retry failed task
- GET /api/v2/tasks - List with filters (status, filename, date range)
- GET /api/v2/tasks/stats - User statistics

Frontend Features:
- Status-based action buttons (Start/Cancel/Retry)
- Advanced search and filtering (status, filename, date range)
- Pagination and sorting
- Task statistics dashboard (5 stat cards)

### 4. Admin Monitoring System ✅ (Backend)
Admin APIs:
- GET /api/v2/admin/stats - System statistics
- GET /api/v2/admin/users - User list with stats
- GET /api/v2/admin/users/top - User leaderboard
- GET /api/v2/admin/audit-logs - Audit log query system
- GET /api/v2/admin/audit-logs/user/{id}/summary

Admin Features:
- Email-based admin check (ymirliu@panjit.com.tw)
- Comprehensive system metrics (users, tasks, sessions, activity)
- Audit logging service for security tracking

### 5. User Isolation & Security ✅
- Row-level security on all task queries
- File access control with ownership validation
- Strict user_id filtering on all operations
- Session validation and expiry checking
- Admin privilege verification

## New Files Created

Backend:
- backend/app/models/user_v2.py - User model for external auth
- backend/app/models/task.py - Task model with user isolation
- backend/app/models/session.py - Session management
- backend/app/models/audit_log.py - Audit log model
- backend/app/services/external_auth_service.py - External API client
- backend/app/services/task_service.py - Task CRUD with isolation
- backend/app/services/file_access_service.py - File access control
- backend/app/services/admin_service.py - Admin operations
- backend/app/services/audit_service.py - Audit logging
- backend/app/routers/auth_v2.py - V2 auth endpoints
- backend/app/routers/tasks.py - Task management endpoints
- backend/app/routers/admin.py - Admin endpoints
- backend/alembic/versions/5e75a59fb763_*.py - DB migration

Frontend:
- frontend/src/services/apiV2.ts - Complete V2 API client
- frontend/src/types/apiV2.ts - V2 type definitions
- frontend/src/pages/TaskHistoryPage.tsx - Task history UI

Modified Files:
- backend/app/core/deps.py - Added get_current_admin_user_v2
- backend/app/main.py - Registered admin router
- frontend/src/pages/LoginPage.tsx - V2 login integration
- frontend/src/components/Layout.tsx - User display and logout
- frontend/src/App.tsx - Added /tasks route

## Documentation
- openspec/changes/.../PROGRESS_UPDATE.md - Detailed progress report

## Pending Items (20%)
1. Database migration execution for audit_logs table
2. Frontend admin dashboard page
3. Frontend audit log viewer

## Testing Status
- Manual testing: ✅ Authentication flow verified
- Unit tests: ⏳ Pending
- Integration tests: ⏳ Pending

## Security Enhancements
- ✅ User isolation (row-level security)
- ✅ File access control
- ✅ Token expiry validation
- ✅ Admin privilege verification
- ✅ Audit logging infrastructure
- ⏳ Token encryption (noted, low priority)
- ⏳ Rate limiting (noted, low priority)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/app/core/deps.py

@@ -13,6 +13,9 @@ from sqlalchemy.orm import Session
 from app.core.database import SessionLocal
 from app.core.security import decode_access_token
 from app.models.user import User
+from app.models.user_v2 import User as UserV2
+from app.models.session import Session as UserSession
+from app.services.admin_service import admin_service
 
 
 logger = logging.getLogger(__name__)
@@ -136,3 +139,143 @@ def get_current_admin_user(
             detail="Not enough privileges"
         )
     return current_user
+
+
+# ===== V2 Dependencies for External Authentication =====
+
+def get_current_user_v2(
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    db: Session = Depends(get_db)
+) -> UserV2:
+    """
+    Get current authenticated user from JWT token (V2 with external auth)
+
+    Args:
+        credentials: HTTP Bearer credentials
+        db: Database session
+
+    Returns:
+        UserV2: Current user object
+
+    Raises:
+        HTTPException: If token is invalid or user not found
+    """
+    credentials_exception = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Could not validate credentials",
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+
+    # Extract token
+    token = credentials.credentials
+
+    # Decode token
+    payload = decode_access_token(token)
+    if payload is None:
+        raise credentials_exception
+
+    # Extract user ID from token
+    user_id_str: Optional[str] = payload.get("sub")
+    if user_id_str is None:
+        raise credentials_exception
+
+    try:
+        user_id: int = int(user_id_str)
+    except (ValueError, TypeError):
+        raise credentials_exception
+
+    # Extract session ID from token (optional)
+    session_id: Optional[int] = payload.get("session_id")
+
+    # Query user from database (using V2 model)
+    user = db.query(UserV2).filter(UserV2.id == user_id).first()
+    if user is None:
+        logger.warning(f"User {user_id} not found in V2 table")
+        raise credentials_exception
+
+    # Check if user is active
+    if not user.is_active:
+        logger.warning(f"Inactive user {user.email} attempted access")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Inactive user"
+        )
+
+    # Validate session if session_id is present
+    if session_id:
+        session = db.query(UserSession).filter(
+            UserSession.id == session_id,
+            UserSession.user_id == user.id
+        ).first()
+
+        if not session:
+            logger.warning(f"Session {session_id} not found for user {user.email}")
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Invalid session",
+                headers={"WWW-Authenticate": "Bearer"},
+            )
+
+        # Check if session is expired
+        if session.is_expired:
+            logger.warning(f"Expired session {session_id} for user {user.email}")
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Session expired, please login again",
+                headers={"WWW-Authenticate": "Bearer"},
+            )
+
+        # Update last accessed time
+        from datetime import datetime
+        session.last_accessed_at = datetime.utcnow()
+        db.commit()
+
+    logger.debug(f"Authenticated user: {user.email} (ID: {user.id})")
+    return user
+
+
+def get_current_active_user_v2(
+    current_user: UserV2 = Depends(get_current_user_v2)
+) -> UserV2:
+    """
+    Get current active user (V2)
+
+    Args:
+        current_user: Current user from get_current_user_v2
+
+    Returns:
+        UserV2: Current active user
+
+    Raises:
+        HTTPException: If user is inactive
+    """
+    if not current_user.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Inactive user"
+        )
+    return current_user
+
+
+def get_current_admin_user_v2(
+    current_user: UserV2 = Depends(get_current_user_v2)
+) -> UserV2:
+    """
+    Get current admin user (V2)
+
+    Args:
+        current_user: Current user from get_current_user_v2
+
+    Returns:
+        UserV2: Current admin user
+
+    Raises:
+        HTTPException: If user is not admin
+    """
+    if not admin_service.is_admin(current_user.email):
+        logger.warning(f"Non-admin user {current_user.email} attempted admin access")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Admin privileges required"
+        )
+    return current_user