add auth verification to fastapi

[RayBB]

This pull request adds FastAPI-based authentication endpoints to Open Library, enabling login, logout, and authentication checks using the same session cookie format as the legacy system. It introduces new authentication dependencies, refactors cookie generation logic for reuse, and includes a test script for local validation. These changes lay the groundwork for a modern API-based authentication flow while maintaining compatibility with existing web.py logic.

FastAPI Authentication Endpoints:

• Added openlibrary/fastapi/account.py with endpoints for login, logout, and authentication status checks, reusing existing account auditing and session cookie logic for compatibility with the legacy system.
• Integrated the new account router into the FastAPI application in openlibrary/asgi_app.py, making the endpoints available.

Authentication Logic and Utilities:

• Introduced openlibrary/fastapi/auth.py, providing dependencies for extracting and verifying authenticated users from session cookies, including models and helper functions for authentication in FastAPI routes.
• Refactored session cookie generation logic into a reusable function generate_login_code_for_user in openlibrary/accounts/model.py and updated the Account.generate_login_code method to use it, ensuring consistent cookie format between legacy and new endpoints. [1] [2]

Testing and Validation:

• Added test_fastapi_auth.sh, a shell script for local testing of FastAPI authentication endpoints, covering login, logout, session cookie handling, and compatibility checks.

Related to #11133

[cdrini]

Lgtm! We tested all the helper endpoints and they did the correct thing (logout excepting). Will bring up with @mekarpeles to do a quick pass of the cookie handling stuff since he's more familiar with authentication.

[cdrini]

This endpoint wasn't working correctly ; we think it might be something related to webpy / fastapi storing the session cookie slightly differently?

Here's the set-cookie header from the two systems:

fastapi:
set-cookie
	session=""; expires=Wed, 21 Jan 2026 18:38:46 GMT; Max-Age=0; Path=/; SameSite=lax
set-cookie
	pd=""; expires=Wed, 21 Jan 2026 18:38:46 GMT; Max-Age=0; Path=/; SameSite=lax
set-cookie
	sfw=""; expires=Wed, 21 Jan 2026 18:38:46 GMT; Max-Age=0; Path=/; SameSite=lax


webpy:
set-cookie
	pd=; expires=Sun, 15 May 1994 16:50:45 GMT; Path=/
set-cookie
	sfw=; expires=Sun, 15 May 1994 16:50:45 GMT; Path=/
set-cookie
	session=; expires=Sun, 15 May 1994 16:50:45 GMT; Path=/

[cdrini]

@mekarpeles and I reviewed and this looks good! Marking as need changes to delete those files we talked about.

[RayBB]

@cdrini all changes are addressed