feat(auth): add opaque bearer sessions

server/tests/test_risk_rule_template_catalog.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from auth_helpers import install_legacy_header_auth_override
 from fastapi.testclient import TestClient
 
 from app.main import create_app
@@ -49,11 +50,13 @@ def test_risk_rule_template_catalog_groups_and_dsl_examples() -> None:
 
 
 def test_risk_rule_template_endpoint_requires_login_and_returns_groups() -> None:
-    client = TestClient(create_app())
+    app = create_app()
+    client = TestClient(app)
 
     unauthorized = client.get("/api/v1/agent-assets/risk-rules/templates")
     assert unauthorized.status_code == 401
 
+    install_legacy_header_auth_override(app)
     response = client.get(
         "/api/v1/agent-assets/risk-rules/templates",
         headers={"x-auth-username": "finance", "x-auth-role-codes": "finance"},