Implement adjudicated DO items across backend, frontend, deploy

From the ROADMAP adjudication (12 of 13 DO items; D2 is a commit action).

Backend:
- B3: pytest suite (auth, entity CRUD, rollup) + dev deps + pytest config
- B4: cap document uploads at TEN31_MAX_UPLOAD_SIZE (default 50MB), stream-
  checked with partial-file cleanup, 413 on overflow
- B7: type AuditLog.detail as dict|list|str|None to match the JSON column
- B10: index foreign-key columns (migration a7b8c9d0e1f2 + index=True)
- B11: cli delete-user logs file-removal errors instead of swallowing them

Frontend:
- F2: distinguish "server unreachable" from "logged out"; retry prompt
- F4: confirm before destructive holdings-replace on import; step progress
- F6: expandable audit-log detail with full JSON
- F7: empty-state on the Investments page
- F8: shared role helpers (WRITER_ROLES/canEditRound/isApprover), used by
  EntitiesList, AuditLog, Import, ValuationWorkflow

Deploy:
- D5: run tsc --noEmit before packaging (build script)
- D6: TEN31_LOG_LEVEL env var (defaults to info)

Verified: 8/8 backend tests pass; alembic upgrades to head with 13 FK
indexes; upload limit rejects oversized + cleans up; frontend tsc + vite
build clean; dev server serves and proxies to the API.

backend/tests/conftest.py

@@ -0,0 +1,77 @@
+"""Shared pytest fixtures: an in-memory DB and a FastAPI TestClient.
+
+The client is created WITHOUT the context-manager form on purpose, so the app lifespan (which
+runs real Alembic migrations against the configured DB_PATH) never fires. Tables come from
+SQLModel.metadata.create_all against a throwaway in-memory database instead.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy.pool import StaticPool
+from sqlmodel import Session, SQLModel, create_engine
+
+import ten31portal.models  # noqa: F401 — importing registers every table on SQLModel.metadata
+from ten31portal.auth import hash_password
+from ten31portal.database import get_session
+from ten31portal.main import app
+from ten31portal.models import User, UserRole
+
+
+@pytest.fixture
+def engine():
+    eng = create_engine(
+        "sqlite://",
+        connect_args={"check_same_thread": False},
+        poolclass=StaticPool,  # one shared in-memory connection across sessions
+    )
+    SQLModel.metadata.create_all(eng)
+    yield eng
+    SQLModel.metadata.drop_all(eng)
+
+
+@pytest.fixture
+def session(engine):
+    with Session(engine) as s:
+        yield s
+
+
+@pytest.fixture
+def client(engine):
+    def override_get_session():
+        with Session(engine) as s:
+            yield s
+
+    app.dependency_overrides[get_session] = override_get_session
+    yield TestClient(app)
+    app.dependency_overrides.clear()
+
+
+def make_user(session, *, username="admin", password="password123",
+              role=UserRole.approver, name="Test User", email=None, **kwargs):
+    user = User(
+        name=name,
+        username=username,
+        email=email,
+        password_hash=hash_password(password),
+        role=role,
+        **kwargs,
+    )
+    session.add(user)
+    session.commit()
+    session.refresh(user)
+    return user
+
+
+@pytest.fixture
+def approver(session):
+    return make_user(session, username="approver", role=UserRole.approver)
+
+
+@pytest.fixture
+def auth_client(client, approver):
+    """A TestClient already logged in as an approver (a writer)."""
+    resp = client.post(
+        "/api/auth/login", json={"login": "approver", "password": "password123"}
+    )
+    assert resp.status_code == 200, resp.text
+    return client

backend/tests/test_auth.py

@@ -0,0 +1,40 @@
+"""Auth: login works, and protected/writer endpoints reject the wrong caller."""
+
+from tests.conftest import make_user
+from ten31portal.models import UserRole
+
+
+def test_login_success(client, approver):
+    resp = client.post(
+        "/api/auth/login", json={"login": "approver", "password": "password123"}
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["username"] == "approver"
+
+
+def test_login_wrong_password(client, approver):
+    resp = client.post(
+        "/api/auth/login", json={"login": "approver", "password": "nope"}
+    )
+    assert resp.status_code == 401
+
+
+def test_me_requires_authentication(client):
+    assert client.get("/api/auth/me").status_code == 401
+
+
+def test_me_returns_current_user(auth_client):
+    resp = auth_client.get("/api/auth/me")
+    assert resp.status_code == 200
+    assert resp.json()["role"] == "approver"
+
+
+def test_writer_endpoint_rejects_viewer(client, session):
+    """A viewer is authenticated but not a writer — create-entity must 403, not 401."""
+    make_user(session, username="viewer", role=UserRole.viewer)
+    login = client.post(
+        "/api/auth/login", json={"login": "viewer", "password": "password123"}
+    )
+    assert login.status_code == 200
+    resp = client.post("/api/entities", json={"name": "X", "type": "fund"})
+    assert resp.status_code == 403

backend/tests/test_entities.py

@@ -0,0 +1,32 @@
+"""Entity CRUD round-trips through the API as a writer."""
+
+
+def test_entity_crud_roundtrip(auth_client):
+    # Create
+    created = auth_client.post(
+        "/api/entities",
+        json={"name": "Ten31 Fund I", "type": "fund", "vintage_year": 2025},
+    )
+    assert created.status_code == 201, created.text
+    entity_id = created.json()["id"]
+
+    # Read (single)
+    got = auth_client.get(f"/api/entities/{entity_id}")
+    assert got.status_code == 200
+    assert got.json()["name"] == "Ten31 Fund I"
+
+    # List
+    listed = auth_client.get("/api/entities")
+    assert listed.status_code == 200
+    assert any(e["id"] == entity_id for e in listed.json())
+
+    # Update
+    patched = auth_client.patch(
+        f"/api/entities/{entity_id}", json={"name": "Ten31 Fund I, LP"}
+    )
+    assert patched.status_code == 200
+    assert patched.json()["name"] == "Ten31 Fund I, LP"
+
+
+def test_get_missing_entity_404(auth_client):
+    assert auth_client.get("/api/entities/99999").status_code == 404

backend/tests/test_rollup.py

@@ -0,0 +1,48 @@
+"""The entity rollup aggregates invested cost and the latest signed valuation correctly."""
+
+from datetime import date
+
+from ten31portal.models import (
+    Entity, EntityType, Holding, Position, RoundStatus, Valuation, ValuationRound,
+)
+
+
+def test_rollup_sums_cost_and_latest_signed_value(auth_client, session):
+    entity = Entity(name="Rollup Fund", type=EntityType.fund)
+    session.add(entity)
+    session.commit()
+    session.refresh(entity)
+
+    holding = Holding(entity_id=entity.id, company_name="Acme")
+    session.add(holding)
+    session.commit()
+    session.refresh(holding)
+
+    position = Position(
+        holding_id=holding.id,
+        security_name="Acme Series A",
+        investment_date=date(2025, 1, 15),
+        cost_cents=100_000,
+    )
+    session.add(position)
+    session.commit()
+    session.refresh(position)
+
+    rnd = ValuationRound(
+        entity_id=entity.id,
+        quarter_end=date(2026, 3, 31),
+        status=RoundStatus.approved,
+    )
+    session.add(rnd)
+    session.commit()
+    session.refresh(rnd)
+
+    session.add(Valuation(round_id=rnd.id, position_id=position.id, value_cents=150_000))
+    session.commit()
+
+    resp = auth_client.get("/api/entities/rollup")
+    assert resp.status_code == 200, resp.text
+    row = next(r for r in resp.json() if r["id"] == entity.id)
+    assert row["invested_cents"] == 100_000
+    assert row["last_signed_value_cents"] == 150_000
+    assert row["committed_cents"] == 0  # no capital-account statements added