fix(auth): require preferred username claim

tests/auth/test_metadata_dependencies.py

@@ -0,0 +1,36 @@
+from types import SimpleNamespace
+from unittest.mock import AsyncMock
+from uuid import uuid4
+
+import pytest
+from fastapi import HTTPException
+
+from app.auth import metadata_dependencies
+
+
+@pytest.fixture
+def anyio_backend():
+    return "asyncio"
+
+
+@pytest.mark.anyio
+async def test_current_metadata_user_rejects_username_claim_fallback():
+    keycloak_id = uuid4()
+    repo = SimpleNamespace(
+        get_user_by_keycloak_id=AsyncMock(),
+        refresh_user_keycloak_snapshot=AsyncMock(),
+    )
+
+    with pytest.raises(HTTPException) as exc:
+        await metadata_dependencies.get_current_metadata_user(
+            {
+                "sub": str(keycloak_id),
+                "username": "legacy-name",
+            },
+            metadata_repo=repo,
+        )
+
+    assert exc.value.status_code == 401
+    assert exc.value.detail == "Missing preferred_username claim"
+    repo.get_user_by_keycloak_id.assert_not_called()
+    repo.refresh_user_keycloak_snapshot.assert_not_called()