Add comprehensive test coverage for user and team management APIs

[Copilot]

Code review requested comprehensive test coverage improvements for user and team management endpoints (create, update, list, delete users; create teams). Added 70+ tests across security, performance, edge cases, and advanced scenarios.

Test Coverage Added

Security Testing (19 tests)

• SQL injection and XSS protection validation
• Password hashing verification (scrypt)
• Control character and null byte injection
• Concurrent user creation race conditions
• Session token security

Edge Cases (23 tests)

• Unicode/emoji handling in all fields
• Extreme input lengths (1000+ chars)
• Email format variations (special chars, multiple @, dots)
• Whitespace and null byte handling
• Pagination boundaries (zero/negative pages, excessive page_size)
• JSON injection attempts

Performance (10 tests)

• Concurrent operations (20+ parallel requests)
• Response time benchmarks (< 1s avg, < 3s max)
• Pagination performance validation
• Sequential vs concurrent comparison
• Memory efficiency with 100+ users

Team Management (18 tests)

• Custom model configurations
• Special characters in team names
• Concurrent team creation
• Unicode team names
• Credit validation (negative/zero)
• Parser IDs handling

Test Organization

# Run by priority
pytest -m p1  # Critical tests
pytest -m p2  # Important tests
pytest -m p3  # Nice-to-have tests

# Run by category
pytest -m security
pytest -m performance
pytest -m edge_cases

All tests follow pytest conventions with proper fixtures, parametrization, and clear assertion messages. Tests validate both success and failure paths with appropriate error messages.

Key Findings Documented

Created comprehensive review findings covering:

• Performance: Pagination loads all users to memory (needs LIMIT/OFFSET), missing DB indexes on email/access_token
• Security: No rate limiting, weak password policy (empty check only), superuser creation unrestricted
• Stability: Team creation lacks transactions (orphaned records possible), race conditions in user creation
• Code quality: Email validation duplicated, 100+ line functions, no Pydantic schemas

Prioritized 15 recommendations: 5 high (transactions, rate limits, password policy, pagination fix, privilege restriction), 7 medium (indexes, caching, sanitization, audit logs), 3 low (utilities, refactoring, metrics).

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.