P0 security batch: admin-only user mgmt, unified role model, login rate limiting, webhook secret, security headers, pagination caps

- Remove POST /api/auth/register (404); no sign-up UI; users are admin-managed
- Add admin-only POST/PATCH/DELETE /api/auth/users (forced canonical roles,
  self-lockout + reference guards)
- Unify role model in app/core/roles.py; reject unknown roles at creation and
  at login/JWT validation; startup normalizes unambiguous legacy aliases
- Login rate limiting ~5 fails/15 min per IP+email -> 429 (in-process, tunable)
- WhatsApp webhook requires X-Webhook-Secret; fail-closed when env unset;
  GET handshake uses constant-time verify token (403 on mismatch)
- GET /api/whatsapp/mock-log now requires auth
- Security headers middleware: X-Frame-Options DENY, nosniff, CSP on HTML,
  HSTS behind TLS
- Pagination: limit alias for page_size, hard cap enforced, both -> 422

tests/conftest.py

@@ -18,16 +18,26 @@ os.environ.setdefault("SECRET_KEY", "test-secret-key-not-for-production-01234567
 os.environ.setdefault("CORS_ORIGINS", "http://test")
 
 import pytest_asyncio  # noqa: E402  (DATABASE_URL must be set before app imports)
+import pytest  # noqa: E402
 from httpx import ASGITransport, AsyncClient  # noqa: E402
 
 from app.core.database import Base, async_session_factory, engine  # noqa: E402
+from app.core.ratelimit import login_rate_limiter  # noqa: E402
 from app.main import app  # noqa: E402
 from app.models.ticket import Ticket  # noqa: E402
 from app.services.seed import seed_categories, seed_units, seed_users  # noqa: E402
 
 
+@pytest.fixture
+def _reset_login_rate_limiter():
+    """Isolate login rate-limit state between tests (shared in-process store)."""
+    login_rate_limiter.reset()
+    yield
+    login_rate_limiter.reset()
+
+
 @pytest_asyncio.fixture
-async def client():
+async def client(_reset_login_rate_limiter):
     """Async test client with a fresh, seeded database per test."""
     async with engine.begin() as conn:
         await conn.run_sync(Base.metadata.create_all)