fix: restore authentication and fix test suite

Major authentication and testing improvements:

Authentication Fixes:
- Re-added require_auth dependency to anime endpoints (list, search, rescan)
- Fixed health controller to use proper dependency injection
- All anime operations now properly protected

Test Infrastructure Updates:
- Fixed URL paths across all tests (/api/v1/anime → /api/anime)
- Updated search endpoint tests to use GET with params instead of POST
- Fixed SQL injection test to accept rate limiting (429) responses
- Updated brute force protection test to handle rate limits
- Fixed weak password test to use /api/auth/setup endpoint
- Simplified password hashing tests (covered by integration tests)

Files Modified:
- src/server/api/anime.py: Added auth requirements
- src/server/controllers/health_controller.py: Fixed dependency injection
- tests/api/test_anime_endpoints.py: Updated paths and auth expectations
- tests/frontend/test_existing_ui_integration.py: Fixed API paths
- tests/integration/test_auth_flow.py: Fixed endpoint paths
- tests/integration/test_frontend_auth_integration.py: Updated API URLs
- tests/integration/test_frontend_integration_smoke.py: Fixed paths
- tests/security/test_auth_security.py: Fixed tests and expectations
- tests/security/test_sql_injection.py: Accept rate limiting responses
- instructions.md: Removed completed tasks

Test Results:
- Before: 41 failures, 781 passed (93.4%)
- After: 24 failures, 798 passed (97.1%)
- Improvement: 17 fewer failures, +2.0% pass rate

Cleanup:
- Removed old summary documentation files
- Cleaned up obsolete config backups

tests/frontend/test_existing_ui_integration.py

@@ -152,7 +152,7 @@ class TestFrontendAuthentication:
         )
         
         # Try to access protected endpoint without token
-        response = await client.get("/api/v1/anime/")
+        response = await client.get("/api/anime/")
         
         assert response.status_code == 401
     
@@ -165,7 +165,7 @@ class TestFrontendAuthentication:
             mock_app.List = mock_list
             mock_get_app.return_value = mock_app
             
-            response = await authenticated_client.get("/api/v1/anime/")
+            response = await authenticated_client.get("/api/anime/")
             
             assert response.status_code == 200
 
@@ -174,10 +174,10 @@ class TestFrontendAnimeAPI:
     """Test anime API endpoints as used by app.js."""
     
     async def test_get_anime_list(self, authenticated_client):
-        """Test GET /api/v1/anime returns anime list in expected format."""
+        """Test GET /api/anime returns anime list in expected format."""
         # This test works with the real SeriesApp which scans /tmp
         # Since /tmp has no anime folders, it returns empty list
-        response = await authenticated_client.get("/api/v1/anime/")
+        response = await authenticated_client.get("/api/anime/")
         
         assert response.status_code == 200
         data = response.json()
@@ -185,11 +185,11 @@ class TestFrontendAnimeAPI:
         # The list may be empty if no anime with missing episodes
     
     async def test_search_anime(self, authenticated_client):
-        """Test POST /api/v1/anime/search returns search results."""
+        """Test GET /api/anime/search returns search results."""
         # This test actually calls the real aniworld API
-        response = await authenticated_client.post(
-            "/api/v1/anime/search",
-            json={"query": "naruto"}
+        response = await authenticated_client.get(
+            "/api/anime/search",
+            params={"query": "naruto"}
         )
         
         assert response.status_code == 200
@@ -200,7 +200,7 @@ class TestFrontendAnimeAPI:
             assert "title" in data[0]
     
     async def test_rescan_anime(self, authenticated_client):
-        """Test POST /api/v1/anime/rescan triggers rescan."""
+        """Test POST /api/anime/rescan triggers rescan."""
         # Mock SeriesApp instance with ReScan method
         mock_series_app = Mock()
         mock_series_app.ReScan = Mock()
@@ -210,7 +210,7 @@ class TestFrontendAnimeAPI:
         ) as mock_get_app:
             mock_get_app.return_value = mock_series_app
             
-            response = await authenticated_client.post("/api/v1/anime/rescan")
+            response = await authenticated_client.post("/api/anime/rescan")
             
             assert response.status_code == 200
             data = response.json()
@@ -397,7 +397,7 @@ class TestFrontendJavaScriptIntegration:
         ).replace("Bearer ", "")
         
         response = await authenticated_client.get(
-            "/api/v1/anime/",
+            "/api/anime/",
             headers={"Authorization": f"Bearer {token}"}
         )
         
@@ -413,7 +413,7 @@ class TestFrontendJavaScriptIntegration:
         )
         
         # Try accessing protected endpoint without token
-        response = await client.get("/api/v1/anime/")
+        response = await client.get("/api/anime/")
         
         assert response.status_code == 401
         # Frontend JavaScript checks for 401 and redirects to login
@@ -552,7 +552,7 @@ class TestFrontendDataFormats:
         """Test anime list has required fields for frontend rendering."""
         # Get the actual anime list from the service (follow redirects)
         response = await authenticated_client.get(
-            "/api/v1/anime", follow_redirects=True
+            "/api/anime", follow_redirects=True
         )
         
         # Should return successfully