Implement Phases 1-5: skeleton, OAuth, categories, video sync/feed, playback

- FastAPI + PostgreSQL + Alembic + React/Vite skeleton, Docker Compose, healthcheck
- Google OAuth (single allowed account), encrypted refresh token storage
- Subscriptions sync with pagination, uploads playlist batch fetch
- Categories CRUD, many-to-many channel assignment, category filtering
- Video sync (playlistItems + videos.list batching), cached feed with cursor
  pagination, background scheduler (APScheduler)
- Video detail page with YouTube embed player
- SPA fallback routing, optimistic UI updates, client-side query caching

40 backend tests covering OAuth allow-list, sync idempotency, cascade deletes,
cursor pagination, and category filtering.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_auth.py

@@ -0,0 +1,79 @@
+import pytest
+from fastapi.testclient import TestClient
+
+from app.api import auth as auth_module
+from app.db import get_db
+from app.main import app
+from app.services import google_oauth
+
+
+@pytest.fixture
+def client(monkeypatch, db_session):
+    def _get_db_override():
+        yield db_session
+
+    app.dependency_overrides[get_db] = _get_db_override
+    monkeypatch.setattr(auth_module, "_run_initial_sync", lambda: None)
+    monkeypatch.setattr(
+        google_oauth, "build_authorization_url", lambda: ("https://accounts.google.com/fake", "fixed-state")
+    )
+    with TestClient(app) as test_client:
+        yield test_client
+    del app.dependency_overrides[get_db]
+
+
+class FakeCredentials:
+    token = "fake-access-token"
+    refresh_token = "fake-refresh-token"
+    expiry = None
+
+
+def _start_oauth(client):
+    response = client.get("/api/auth/google/start", follow_redirects=False)
+    assert response.status_code in (302, 307)
+    return "fixed-state"
+
+
+def test_callback_rejects_disallowed_email(client, monkeypatch):
+    state = _start_oauth(client)
+
+    monkeypatch.setattr(google_oauth, "exchange_code", lambda code, state: FakeCredentials())
+    monkeypatch.setattr(google_oauth, "fetch_userinfo", lambda token: {"email": "stranger@example.com"})
+    revoked = {}
+    monkeypatch.setattr(google_oauth, "revoke_token", lambda token: revoked.setdefault("called", True))
+
+    response = client.get(f"/api/auth/google/callback?code=abc&state={state}", follow_redirects=False)
+
+    assert response.status_code in (302, 307)
+    assert "account_not_allowed" in response.headers["location"]
+    assert revoked.get("called") is True
+
+    status = client.get("/api/auth/status").json()
+    assert status["authenticated"] is False
+    assert status["connected"] is False
+
+
+def test_callback_accepts_allowed_email(client, monkeypatch):
+    state = _start_oauth(client)
+
+    monkeypatch.setattr(google_oauth, "exchange_code", lambda code, state: FakeCredentials())
+    monkeypatch.setattr(google_oauth, "fetch_userinfo", lambda token: {"email": "owner@example.com"})
+
+    response = client.get(f"/api/auth/google/callback?code=abc&state={state}", follow_redirects=False)
+
+    assert response.status_code in (302, 307)
+    assert "auth_error" not in response.headers["location"]
+
+    status = client.get("/api/auth/status").json()
+    assert status["authenticated"] is True
+    assert status["connected"] is True
+    assert status["email"] == "owner@example.com"
+
+
+def test_callback_rejects_invalid_state(client, monkeypatch):
+    _start_oauth(client)
+
+    response = client.get("/api/auth/google/callback?code=abc&state=wrong-state", follow_redirects=False)
+
+    assert response.status_code in (302, 307)
+    assert "invalid_state" in response.headers["location"]