feat(auth): gate existing endpoints with matrix_gate dependency

backend/tests/conftest.py

@@ -10,26 +10,51 @@ requires the engine to be initialized before any DB access, whereas the
 old in-memory store did not. Adding the init here keeps existing test
 modules (test_api.py, test_api_835.py, test_api_gets.py,
 test_api_parse_persists.py) working unchanged.
+
+Auth posture: ``CYCLONE_AUTH_DISABLED`` defaults to ``"1"`` here so the
+existing test suite (700+ tests that don't log in) continues to pass
+unmodified. Tests in ``test_auth_*`` modules explicitly re-enable auth
+so they exercise the real ``get_current_user`` / ``matrix_gate`` paths.
 """
 
 from __future__ import annotations
 
+import os
+
+# Must be set before ``cyclone.api`` is imported so ``get_current_user``
+# / ``matrix_gate`` see the env var. The module-level ``AUTH_DISABLED``
+# flag in ``cyclone.auth.deps`` is flipped per-test below.
+os.environ.setdefault("CYCLONE_AUTH_DISABLED", "1")
+
 import pytest
 
 
 @pytest.fixture(autouse=True)
-def _auto_init_db(tmp_path, monkeypatch):
+def _auto_init_db(tmp_path, monkeypatch, request):
     """Point CYCLONE_DB_URL at a per-test SQLite file and init the schema.
 
     Also wires a fresh ``EventBus`` onto ``app.state`` because ``TestClient``
     does not invoke the FastAPI lifespan handler unless used as a context
     manager. The bus is reset between tests so subscribers don't leak.
+
+    Auth posture is set per-test from the test module's name: legacy
+    tests (any module not starting with ``test_auth``) run with
+    ``AUTH_DISABLED=True`` so they hit the API without logging in;
+    ``test_auth_*`` modules run with ``AUTH_DISABLED=False`` so they
+    exercise the real ``get_current_user`` / ``matrix_gate`` paths.
     """
     monkeypatch.setenv("CYCLONE_DB_URL", f"sqlite:///{tmp_path}/test.db")
     from cyclone import db
     from cyclone.api import app
+    from cyclone.auth import deps as _auth_deps
     from cyclone.pubsub import EventBus
 
+    test_module = request.node.module.__name__
+    if test_module.startswith("test_auth"):
+        _auth_deps.AUTH_DISABLED = False
+    else:
+        _auth_deps.AUTH_DISABLED = True
+
     db._reset_for_tests()
     db.init_db()
     app.state.event_bus = EventBus()