agent-07 phase 2: fix test isolation + CSV import UI

- Fix conftest.py: commit after each request in override_get_db so
  preview_csv's rollback no longer wipes the shared registered_user
  (root cause of 401 cascade across test_user_import + test_personnel_number)
- Fix limiter.enabled=False in client fixture (blocks rate-limit 429)
- Fix user_import_service: allow reactivation when personnel number
  belongs to the same user being reactivated
- Fix test_personnel_number: use PATCH /companies/me (not /companies/{id})
  and add try/finally cleanup for personnel_number_required flag
- Frontend UsersPage: add CSV import modal with template download,
  preview/validation table, and guarded apply button

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/conftest.py

@@ -6,6 +6,7 @@ from sqlalchemy import text
 
 from app.main import app
 from app.core.database import Base, get_db
+from app.core.limiter import limiter
 
 # Echte PostgreSQL Test-Datenbank (kein SQLite – Models nutzen JSONB/UUID)
 TEST_DATABASE_URL = "postgresql+asyncpg://timemaster:timemaster_secret_change_me@localhost:5432/timemaster_test"
@@ -41,9 +42,15 @@ async def db_session():
 @pytest_asyncio.fixture(scope="session", loop_scope="session")
 async def client(db_session: AsyncSession):
     async def override_get_db():
-        yield db_session
+        try:
+            yield db_session
+            await db_session.commit()
+        except Exception:
+            await db_session.rollback()
+            raise
 
     app.dependency_overrides[get_db] = override_get_db
+    limiter.enabled = False  # Rate-Limiter in Tests deaktivieren
 
     async with AsyncClient(
         transport=ASGITransport(app=app),
@@ -51,6 +58,7 @@ async def client(db_session: AsyncSession):
     ) as ac:
         yield ac
 
+    limiter.enabled = True
     app.dependency_overrides.clear()
 
 

backend/tests/test_personnel_number.py

@@ -80,9 +80,8 @@ async def test_next_personnel_number_endpoint(client: AsyncClient, registered_us
 
 async def test_auto_mode_assigns_personnel_number(client: AsyncClient, registered_user):
     h = auth(registered_user["tokens"])
-    cid = registered_user["user"]["company_id"]
     # Modus auf auto setzen
-    upd = await client.patch(f"{COMPANIES_URL}/{cid}", headers=h, json={
+    upd = await client.patch(f"{COMPANIES_URL}/me", headers=h, json={
         "personnel_number_mode": "auto",
     })
     assert upd.status_code == 200
@@ -94,26 +93,26 @@ async def test_auto_mode_assigns_personnel_number(client: AsyncClient, registere
     nr = r.json()["personnel_number"]
     assert nr is not None and nr.isdigit()
     # zurück auf manual
-    await client.patch(f"{COMPANIES_URL}/{cid}", headers=h, json={
+    await client.patch(f"{COMPANIES_URL}/me", headers=h, json={
         "personnel_number_mode": "manual",
     })
 
 
 async def test_required_flag_blocks_invite_without_number(client: AsyncClient, registered_user):
     h = auth(registered_user["tokens"])
-    cid = registered_user["user"]["company_id"]
-    # Pflicht aktivieren
-    await client.patch(f"{COMPANIES_URL}/{cid}", headers=h, json={
+    upd = await client.patch(f"{COMPANIES_URL}/me", headers=h, json={
         "personnel_number_required": True,
     })
-    r = await client.post(INVITE_URL, headers=h, json={
-        "email": "noreq@test.de", "first_name": "X", "last_name": "X",
-    })
-    assert r.status_code == 400
-    # Cleanup
-    await client.patch(f"{COMPANIES_URL}/{cid}", headers=h, json={
-        "personnel_number_required": False,
-    })
+    assert upd.status_code == 200
+    try:
+        r = await client.post(INVITE_URL, headers=h, json={
+            "email": "noreq2@test.de", "first_name": "X", "last_name": "X",
+        })
+        assert r.status_code == 400
+    finally:
+        await client.patch(f"{COMPANIES_URL}/me", headers=h, json={
+            "personnel_number_required": False,
+        })
 
 
 # ── Lookup ───────────────────────────────────────────────────────────────────