feat: apply rel-001 feedback cleanup

tests/test_auth.py

@@ -283,3 +283,35 @@ def test_post_auth_tokens_returns_404(monkeypatch) -> None:
 
     _app.dependency_overrides.clear()
     assert response.status_code in (404, 405)
+
+
+# REQ-034: LoginRequest extra="forbid" enforcement (dcy-005 FR-2)
+
+def test_login_rejects_no_expiry_extra_field(monkeypatch) -> None:
+    """REQ-034 AC-2: session 발급 경로에 no_expiry 시도 → HTTP 422 (extra="forbid")."""
+    monkeypatch.setenv("PORTFOLIOHUB_DB_ENABLED", "false")
+    get_settings.cache_clear()
+    client = TestClient(app)
+
+    resp = client.post(
+        "/auth/login",
+        json={"username": "anyone", "password": "any", "no_expiry": True},
+    )
+
+    assert resp.status_code == 422
+    body = resp.json()
+    assert any("extra" in (err.get("type") or "") for err in body.get("detail", []))
+
+
+def test_login_rejects_arbitrary_extra_field(monkeypatch) -> None:
+    """REQ-034 AC-3: 임의 추가 필드 → HTTP 422 (extra="forbid" 일반 동작)."""
+    monkeypatch.setenv("PORTFOLIOHUB_DB_ENABLED", "false")
+    get_settings.cache_clear()
+    client = TestClient(app)
+
+    resp = client.post(
+        "/auth/login",
+        json={"username": "anyone", "password": "any", "arbitrary_field": "x"},
+    )
+
+    assert resp.status_code == 422