feat(backend): exchange miniprogram webview tickets for JWT sessions.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_mp_webview_auth_api.py

@@ -0,0 +1,22 @@
+"""小程序 WebView ticket 签发 / 兑换 HTTP 接口。"""
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+client = TestClient(app)
+
+
+def test_mp_webview_ticket_requires_bearer():
+    resp = client.post("/api/web/auth/mp-webview-ticket")
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["code"] == 401
+    assert body["message"] == "未授权"
+
+
+def test_mp_webview_exchange_requires_ticket():
+    resp = client.post("/api/web/auth/mp-webview-exchange", json={})
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["code"] == 400
+    assert body["message"] == "ticket不能为空"