Phase 1 MVP - Complete implementation

- Auth: register, login, JWT with refresh tokens, blocklist
- Projects/Folders/Documents CRUD with soft deletes
- Tags CRUD and assignment
- FTS5 search with highlights and tag filtering
- ADR-001, ADR-002, ADR-003 compliant
- Security fixes applied (JWT_SECRET_KEY, exception handler, cookie secure)
- 25 tests passing

tests/test_search.py

@@ -0,0 +1,69 @@
+import pytest
+
+
+async def setup_project_and_get_token(client):
+    await client.post("/api/v1/auth/register", json={"username": "searchuser", "password": "pass123"})
+    login = await client.post("/api/v1/auth/login", json={"username": "searchuser", "password": "pass123"})
+    token = login.json()["access_token"]
+    proj_resp = await client.post(
+        "/api/v1/projects",
+        json={"name": "Search Test Project"},
+        headers={"Authorization": f"Bearer {token}"}
+    )
+    return token, proj_resp.json()["id"]
+
+
+@pytest.mark.asyncio
+async def test_search_basic(client):
+    token, proj_id = await setup_project_and_get_token(client)
+    await client.post(
+        f"/api/v1/projects/{proj_id}/documents",
+        json={"title": "Python Tutorial", "content": "Learn Python programming language"},
+        headers={"Authorization": f"Bearer {token}"}
+    )
+    await client.post(
+        f"/api/v1/projects/{proj_id}/documents",
+        json={"title": "Rust Tutorial", "content": "Learn Rust programming language"},
+        headers={"Authorization": f"Bearer {token}"}
+    )
+    response = await client.get(
+        "/api/v1/search?q=Python",
+        headers={"Authorization": f"Bearer {token}"}
+    )
+    assert response.status_code == 200
+    results = response.json()["results"]
+    assert len(results) == 1
+    assert results[0]["title"] == "Python Tutorial"
+
+
+@pytest.mark.asyncio
+async def test_search_returns_excerpt_with_highlight(client):
+    token, proj_id = await setup_project_and_get_token(client)
+    await client.post(
+        f"/api/v1/projects/{proj_id}/documents",
+        json={"title": "FastAPI Guide", "content": "Building APIs with FastAPI framework"},
+        headers={"Authorization": f"Bearer {token}"}
+    )
+    response = await client.get(
+        "/api/v1/search?q=FastAPI",
+        headers={"Authorization": f"Bearer {token}"}
+    )
+    results = response.json()["results"]
+    assert len(results) == 1
+    assert "**FastAPI**" in results[0]["excerpt"]
+
+
+@pytest.mark.asyncio
+async def test_search_no_results(client):
+    token, proj_id = await setup_project_and_get_token(client)
+    await client.post(
+        f"/api/v1/projects/{proj_id}/documents",
+        json={"title": "Random Doc", "content": "Some random content"},
+        headers={"Authorization": f"Bearer {token}"}
+    )
+    response = await client.get(
+        "/api/v1/search?q=nonexistent",
+        headers={"Authorization": f"Bearer {token}"}
+    )
+    assert response.status_code == 200
+    assert len(response.json()["results"]) == 0