mizan-fastapi e2e — example app + Playwright harness, 14/14 green

Demonstration milestone. The substrate work earlier in the session
established that mizan-fastapi can dispatch RPC, bundle context
fetches, and emit invalidation envelopes via TestClient (in-process
ASGI). This commit closes the demonstration gap: a real FastAPI server
on port 8001 + a real React harness on port 5175 + Playwright in real
Chromium, exercising generated hooks.

What ships:

backends/mizan-fastapi/src/mizan_fastapi/cli.py — schema-export CLI:
- `python -m mizan_fastapi.cli <module>` imports the named module
  (triggering @client decorations + register() side effects), then
  prints the OpenAPI schema to stdout. Mirrors mizan-django's
  `manage.py export_mizan_schema` so the codegen consumes either
  backend the same subprocess way.

backends/mizan-django/generate/generator/lib/fetch.mjs — codegen now
dispatches on source.django vs source.fastapi. Refactored the
subprocess plumbing into a shared runSubprocess helper. The codegen
package is still named "mizan-django" by historical accident — it's
the framework-agnostic CLI now (a rename for later).

backends/mizan-fastapi/src/mizan_fastapi/executor.py — bug fix:
mizan_core's @client decorator normalizes auth=True to
meta['auth']='required'. The executor's match was only handling True,
not 'required', so any auth-required endpoint failed with
INTERNAL_ERROR. Now matches both. Caught when wiring up the FastAPI
example backend's whoami fixture; would have surfaced first time any
real FastAPI app used auth=True.

backends/mizan-fastapi/tests/test_dispatch.py — added AuthTests
covering the auth=True path so the bug fix has unit coverage. Suite
now 12/12.

examples/fastapi-react-site/ — parallel to examples/django-react-site/:
- backend/main.py: FastAPI app with 11 @client fixtures matching the
  harness surface (echo, add, multiply, whoami, staff/superuser/
  verified-only, notImplementedFn, buggyFn, permissionCheckFn,
  current_user context). Drops Django-only stuff (forms, channels,
  ws-whoami, session-bound JWT).
- harness/: vite proxy → FastAPI on 8001; generated api/ produced by
  the codegen against fastapi.config.mjs.
- mizan.spec.ts: Playwright suite, 14 tests covering the same axes
  as Django minus channel-chat.
- ContextCurrentUser fixture renders 'loading' until data arrives
  rather than emitting <pre>null</pre> — fixes a race the Django
  harness has too (just doesn't trip in practice).

Verified:
- mizan-fastapi unit:    12/12 (incl. new auth=True coverage)
- mizan-fastapi e2e:     14/14 (Playwright via real Chromium)
- mizan-core unit:       15/15
- mizan-django unit:     348 pass, 21 skip
- AFI conformance:        3/3
- mizan-django e2e:      14/15 (1 skip — channels, deferred)

What remains for FastAPI side:
- Dockerfile.test + docker-compose.test.yml so CI can run the e2e
  in the same containerized way as the Django example.
- Makefile test-integration target for symmetry.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

examples/fastapi-react-site/mizan.spec.ts

@@ -0,0 +1,139 @@
+/**
+ * mizan-fastapi e2e — Real Chromium → React with generated hooks → real FastAPI server.
+ *
+ * Mirrors examples/django-react-site/mizan.spec.ts minus channel/form tests
+ * (those features are Django-only — FastAPI projects use native equivalents
+ * or skip them entirely).
+ */
+
+import { test, expect } from '@playwright/test'
+
+const BASE = process.env.HARNESS_URL || 'http://localhost:5175'
+
+async function fixture(page: any, name: string) {
+    await page.goto(`${BASE}#${name}`)
+    await page.waitForSelector('[data-testid="result"], [data-testid="error-type"]', { timeout: 10000 })
+}
+
+async function getResult(page: any): Promise<any> {
+    const el = page.locator('[data-testid="result"]')
+    if (await el.count() > 0) return JSON.parse(await el.textContent())
+    return null
+}
+
+async function getError(page: any) {
+    const typeEl = page.locator('[data-testid="error-type"]')
+    if (await typeEl.count() === 0) return null
+    return {
+        type: await typeEl.textContent(),
+        code: await page.locator('[data-testid="error-code"]').textContent(),
+        message: await page.locator('[data-testid="error-message"]').textContent(),
+    }
+}
+
+// ─── Function hooks ─────────────────────────────────────────────────────────
+
+test.describe('generated function hooks', () => {
+    test('useEcho returns echoed text', async ({ page }) => {
+        await fixture(page, 'echo')
+        const result = await getResult(page)
+        expect(result.message).toBe('e2e-test')
+    })
+
+    test('useAdd returns correct sum', async ({ page }) => {
+        await fixture(page, 'add')
+        const result = await getResult(page)
+        expect(result.result).toBe(42)
+    })
+
+    test('useMultiply returns product', async ({ page }) => {
+        await fixture(page, 'multiply')
+        const result = await getResult(page)
+        expect(result.product).toBe(42)
+    })
+
+    test('usePermissionCheckFn succeeds with correct secret', async ({ page }) => {
+        await fixture(page, 'permission-success')
+        const result = await getResult(page)
+        expect(result.message).toBe('access granted')
+    })
+})
+
+// ─── Error codes ────────────────────────────────────────────────────────────
+
+test.describe('error codes from generated hooks', () => {
+    test('non-existent function → MizanError NOT_FOUND', async ({ page }) => {
+        await fixture(page, 'not-found')
+        const error = await getError(page)
+        expect(error!.type).toBe('MizanError')
+        expect(error!.code).toBe('NOT_FOUND')
+    })
+
+    test('wrong input types → MizanError VALIDATION_ERROR', async ({ page }) => {
+        await fixture(page, 'validation-error')
+        const error = await getError(page)
+        expect(error!.type).toBe('MizanError')
+        expect(error!.code).toBe('VALIDATION_ERROR')
+    })
+
+    test('useWhoami anonymous → auth error', async ({ page }) => {
+        await fixture(page, 'auth-required')
+        const error = await getError(page)
+        expect(error!.type).toBe('MizanError')
+        expect(['UNAUTHORIZED', 'FORBIDDEN']).toContain(error!.code)
+    })
+
+    test('useStaffOnly anonymous → UNAUTHORIZED', async ({ page }) => {
+        await fixture(page, 'staff-only')
+        const error = await getError(page)
+        expect(error!.type).toBe('MizanError')
+        expect(['UNAUTHORIZED', 'FORBIDDEN']).toContain(error!.code)
+    })
+
+    test('useSuperuserOnly anonymous → UNAUTHORIZED', async ({ page }) => {
+        await fixture(page, 'superuser-only')
+        const error = await getError(page)
+        expect(error!.type).toBe('MizanError')
+        expect(['UNAUTHORIZED', 'FORBIDDEN']).toContain(error!.code)
+    })
+
+    test('useVerifiedOnly anonymous → FORBIDDEN', async ({ page }) => {
+        await fixture(page, 'verified-only')
+        const error = await getError(page)
+        expect(error!.type).toBe('MizanError')
+        expect(['UNAUTHORIZED', 'FORBIDDEN']).toContain(error!.code)
+    })
+
+    test('useNotImplementedFn → NOT_IMPLEMENTED', async ({ page }) => {
+        await fixture(page, 'not-implemented')
+        const error = await getError(page)
+        expect(error!.type).toBe('MizanError')
+        expect(error!.code).toBe('NOT_IMPLEMENTED')
+    })
+
+    test('useBuggyFn → INTERNAL_ERROR', async ({ page }) => {
+        await fixture(page, 'internal-error')
+        const error = await getError(page)
+        expect(error!.type).toBe('MizanError')
+        expect(error!.code).toBe('INTERNAL_ERROR')
+    })
+
+    test('usePermissionCheckFn wrong secret → FORBIDDEN', async ({ page }) => {
+        await fixture(page, 'permission-error')
+        const error = await getError(page)
+        expect(error!.type).toBe('MizanError')
+        expect(error!.code).toBe('FORBIDDEN')
+    })
+})
+
+// ─── Context hooks ──────────────────────────────────────────────────────────
+
+test.describe('generated context hooks', () => {
+    test('useCurrentUser returns anonymous data', async ({ page }) => {
+        await page.goto(`${BASE}#context-current-user`)
+        await page.waitForSelector('[data-testid="result"]', { timeout: 10000 })
+        const result = await getResult(page)
+        expect(result.authenticated).toBe(false)
+        expect(result.email).toBe('')
+    })
+})