feat: TDD Phase 1 — 44 backend API tests passing

Test infrastructure:
- conftest.py with SQLite in-memory DB, isolated per-test cleanup
- pytest.ini with asyncio auto mode
- Fixtures: admin/dba/developer/guest/disabled users, tokens, test instance

Test coverage (44 tests):
- test_auth: login/logout/me/token expiry (8 tests)
- test_users: CRUD + role permissions (8 tests)
- test_instances: CRUD + connection test mock (8 tests)
- test_tickets: CRUD + review/execute workflow + pagination (11 tests)
- test_query: select/drop/delete rejection + guest deny (4 tests)
- test_dashboard: stats + auth check (2 tests)

Backend fix:
- query endpoint now catches ValueError from QueryService → 400 instead of 500

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/tests/test_instances.py

@@ -0,0 +1,113 @@
+import sys
+import types
+from unittest.mock import patch, AsyncMock, MagicMock
+
+from httpx import AsyncClient
+
+from tests.conftest import auth_header
+
+
+def _make_aiomysql_mock():
+    aiomysql = MagicMock()
+    aiomysql.connect = AsyncMock()
+    aiomysql.DictCursor = MagicMock()
+    return aiomysql
+
+
+class TestListInstances:
+    async def test_list_instances(self, client: AsyncClient, admin_user, admin_token):
+        resp = await client.get("/api/v1/instances", headers=auth_header(admin_token))
+        assert resp.status_code == 200
+        assert isinstance(resp.json(), list)
+
+
+class TestCreateInstance:
+    async def test_create_instance(self, client: AsyncClient, admin_token):
+        resp = await client.post("/api/v1/instances", headers=auth_header(admin_token), json={
+            "name": "生产MySQL",
+            "db_type": "mysql",
+            "host": "10.0.0.1",
+            "port": 3306,
+            "username": "root",
+            "password": "secret",
+            "database": "prod",
+            "env": "production",
+        })
+        assert resp.status_code == 201
+        data = resp.json()
+        assert data["name"] == "生产MySQL"
+        assert data["db_type"] == "mysql"
+
+    async def test_create_instance_non_admin(self, client: AsyncClient, developer_token):
+        resp = await client.post("/api/v1/instances", headers=auth_header(developer_token), json={
+            "name": "非法创建",
+            "db_type": "mysql",
+            "host": "10.0.0.1",
+            "port": 3306,
+            "username": "root",
+            "password": "secret",
+        })
+        assert resp.status_code == 403
+
+
+class TestGetInstance:
+    async def test_get_instance(self, client: AsyncClient, test_instance, admin_token):
+        resp = await client.get(
+            f"/api/v1/instances/{test_instance.id}",
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 200
+        assert resp.json()["name"] == "测试MySQL"
+
+    async def test_get_nonexistent_instance(self, client: AsyncClient, admin_token):
+        resp = await client.get("/api/v1/instances/9999", headers=auth_header(admin_token))
+        assert resp.status_code == 404
+
+
+class TestUpdateInstance:
+    async def test_update_instance(self, client: AsyncClient, test_instance, admin_token):
+        resp = await client.put(
+            f"/api/v1/instances/{test_instance.id}",
+            headers=auth_header(admin_token),
+            json={"name": "改名MySQL"},
+        )
+        assert resp.status_code == 200
+        assert resp.json()["name"] == "改名MySQL"
+
+
+class TestDeleteInstance:
+    async def test_delete_instance(self, client: AsyncClient, test_instance, admin_token):
+        resp = await client.delete(
+            f"/api/v1/instances/{test_instance.id}",
+            headers=auth_header(admin_token),
+        )
+        assert resp.status_code == 200
+
+
+class TestConnectionTest:
+    async def test_connection_test(self, client: AsyncClient, test_instance, admin_token):
+        from contextlib import asynccontextmanager
+
+        mock_cursor = AsyncMock()
+        mock_cursor.execute = AsyncMock()
+        mock_cursor.fetchone.return_value = ("8.0.30",)
+
+        @asynccontextmanager
+        async def mock_cursor_ctx(*args, **kwargs):
+            yield mock_cursor
+
+        mock_conn = AsyncMock()
+        mock_conn.cursor = mock_cursor_ctx
+        mock_conn.close = MagicMock()
+
+        mock_aiomysql = _make_aiomysql_mock()
+        mock_aiomysql.connect = AsyncMock(return_value=mock_conn)
+
+        with patch.dict(sys.modules, {"aiomysql": mock_aiomysql}):
+            resp = await client.post(
+                f"/api/v1/instances/{test_instance.id}/test",
+                headers=auth_header(admin_token),
+            )
+            assert resp.status_code == 200
+            data = resp.json()
+            assert data["success"] is True