fix(auth): auth deps use their own DB session; smoke suites made dataset-independent

RUNTIME BUG (caught by live smoke tests): the global auth dependency
queried the request-scoped session, auto-beginning its transaction — any
endpoint opening 'async with db.begin()' afterwards crashed with
'transaction already begun' (POST /materials 500). get_current_user /
get_actor now resolve in a short-lived session (expire_on_commit=False
keeps the context usable detached); inventory/pm scopes keep passing the
request session explicitly.

Smoke suites rewritten against CURRENT contracts:
- assertions are behavior-based (shapes, envelopes, filters), no magic
  seed counts; dynamic lookups instead of hard-coded names/ids
- rerun-tolerant: tolerate 409-on-create by reusing prior artifacts
- aligned with current rules: revert blocked after inventory receipts
  (v2.6), attachments allowed in every status, termsheets optional at
  quote level
- SMOKE_USER/SMOKE_PASSWORD env for login (default tester/123456)

Verified on a fresh volume: migration + audit_log bootstrap, Casdoor
seed (bcrypt), demo data, and 29+76+61 smoke checks all green.

backend/app/utils/security.py

@@ -5,16 +5,18 @@ a token leak into the database). All routes that use it now sit behind the
 global JWT dependency, so the token is resolved to the authenticated user
 and the display name is recorded instead.
 """
-from fastapi import Depends, Request
-from sqlalchemy.ext.asyncio import AsyncSession
+from fastapi import Request
 
 from app.auth import get_optional_user
-from app.db.engine import get_db
 
 
-async def get_actor(request: Request, db: AsyncSession = Depends(get_db)) -> str | None:
-    """Resolve the caller's display name from the Casdoor Bearer token."""
-    ctx = await get_optional_user(request, db)
+async def get_actor(request: Request) -> str | None:
+    """Resolve the caller's display name from the Casdoor Bearer token.
+
+    Uses its own session (get_optional_user default) — same reason as
+    get_current_user: quote routers open explicit db.begin() blocks.
+    """
+    ctx = await get_optional_user(request)
     if ctx is not None:
         return ctx.display_name
     # Dev-mode header fallback (only active when DEV_LOGIN_ENABLED) carries