feat: implement user authentication module

- Backend (FastAPI):
  - External API authentication (pj-auth-api.vercel.app)
  - JWT token validation with Redis session storage
  - RBAC with department isolation
  - User, Role, Department models with pjctrl_ prefix
  - Alembic migrations with project-specific version table
  - Complete test coverage (13 tests)

- Frontend (React + Vite):
  - AuthContext for state management
  - Login page with error handling
  - Protected route component
  - Dashboard with user info display

- OpenSpec:
  - 7 capability specs defined
  - add-user-auth change archived

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/tests/test_users.py

@@ -0,0 +1,159 @@
+import pytest
+from app.models.user import User
+from app.models.department import Department
+
+
+class TestUserEndpoints:
+    """Test user management API endpoints."""
+
+    def test_list_users_as_admin(self, client, admin_token):
+        """Test listing users as admin."""
+        response = client.get(
+            "/api/users",
+            headers={"Authorization": f"Bearer {admin_token}"},
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert isinstance(data, list)
+        assert len(data) >= 1  # At least admin user exists
+
+    def test_get_user_by_id(self, client, admin_token):
+        """Test getting a specific user."""
+        response = client.get(
+            "/api/users/00000000-0000-0000-0000-000000000001",
+            headers={"Authorization": f"Bearer {admin_token}"},
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["email"] == "ymirliu@panjit.com.tw"
+
+    def test_get_nonexistent_user(self, client, admin_token):
+        """Test getting a user that doesn't exist."""
+        response = client.get(
+            "/api/users/nonexistent-id",
+            headers={"Authorization": f"Bearer {admin_token}"},
+        )
+        assert response.status_code == 404
+
+    def test_update_user(self, client, admin_token, db):
+        """Test updating a user."""
+        # Create a test user
+        test_user = User(
+            id="test-user-001",
+            email="test@example.com",
+            name="Test User",
+            is_active=True,
+        )
+        db.add(test_user)
+        db.commit()
+
+        response = client.patch(
+            "/api/users/test-user-001",
+            headers={"Authorization": f"Bearer {admin_token}"},
+            json={"name": "Updated Name"},
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["name"] == "Updated Name"
+
+    def test_cannot_modify_system_admin_as_non_admin(self, client, db, mock_redis):
+        """Test that non-admin cannot modify system admin."""
+        from app.core.security import create_access_token, create_token_payload
+
+        # Create a non-admin user
+        non_admin = User(
+            id="non-admin-001",
+            email="nonadmin@example.com",
+            name="Non Admin",
+            role_id="00000000-0000-0000-0000-000000000003",  # engineer role
+            is_active=True,
+            is_system_admin=False,
+        )
+        db.add(non_admin)
+        db.commit()
+
+        # Create token for non-admin
+        token_data = create_token_payload(
+            user_id="non-admin-001",
+            email="nonadmin@example.com",
+            role="engineer",
+            department_id=None,
+            is_system_admin=False,
+        )
+        token = create_access_token(token_data)
+        mock_redis.setex("session:non-admin-001", 900, token)
+
+        # Try to modify system admin - should fail with 403
+        response = client.patch(
+            "/api/users/00000000-0000-0000-0000-000000000001",
+            headers={"Authorization": f"Bearer {token}"},
+            json={"name": "Hacked Name"},
+        )
+        # Engineer role doesn't have users.write permission
+        assert response.status_code == 403
+
+
+class TestDepartmentIsolation:
+    """Test department-based access control."""
+
+    def test_department_isolation(self, client, db, mock_redis):
+        """Test that users can only see users in their department."""
+        from app.core.security import create_access_token, create_token_payload
+
+        # Create departments
+        dept_a = Department(id="dept-a", name="Department A")
+        dept_b = Department(id="dept-b", name="Department B")
+        db.add_all([dept_a, dept_b])
+
+        # Create manager role
+        from app.models.role import Role
+        manager_role = Role(
+            id="manager-role",
+            name="manager",
+            permissions={"users.read": True, "users.write": True},
+        )
+        db.add(manager_role)
+
+        # Create users in different departments
+        user_a = User(
+            id="user-a",
+            email="usera@example.com",
+            name="User A",
+            department_id="dept-a",
+            role_id="manager-role",
+            is_active=True,
+        )
+        user_b = User(
+            id="user-b",
+            email="userb@example.com",
+            name="User B",
+            department_id="dept-b",
+            role_id="manager-role",
+            is_active=True,
+        )
+        db.add_all([user_a, user_b])
+        db.commit()
+
+        # Create token for user A
+        token_data = create_token_payload(
+            user_id="user-a",
+            email="usera@example.com",
+            role="manager",
+            department_id="dept-a",
+            is_system_admin=False,
+        )
+        token = create_access_token(token_data)
+        mock_redis.setex("session:user-a", 900, token)
+
+        # User A should only see users in dept-a
+        response = client.get(
+            "/api/users",
+            headers={"Authorization": f"Bearer {token}"},
+        )
+        assert response.status_code == 200
+        data = response.json()
+
+        # Should only contain user A (filtered by department)
+        emails = [u["email"] for u in data]
+        assert "usera@example.com" in emails
+        assert "userb@example.com" not in emails