feat: finish forecast rendering and account-authenticated API explorer

tests/test_accounts.py

@@ -115,3 +115,13 @@ def test_reset_template(client):
         client.get("/api/v1/templates/quote").json()["defaults"]["title"]
         != "Saved title"
     )
+
+
+def test_openapi_describes_cookie_auth_and_docs_csrf(client):
+    schema = client.get("/openapi.json").json()
+    cookie = schema["components"]["securitySchemes"]["AccountSession"]
+    assert cookie["in"] == "cookie" and cookie["name"] == "frameflow_session"
+    assert {"AccountSession": []} in schema["paths"]["/api/v1/devices"]["get"][
+        "security"
+    ]
+    assert "X-CSRF-Token" in client.get("/docs").text

tests/test_weather.py

@@ -125,3 +125,13 @@ def test_image_url_allowlist_is_persistent_and_restrictive(client, service):
     ).json()["allowed_hosts"] == ["example.com"]
     assert service.settings.image_url_hosts == ["example.com"]
     assert service.db.one("SELECT payload FROM app_config WHERE key='image_url_hosts'")
+
+
+def test_weather_template_resolves_forecast(service):
+    provider = ConfigurableWeatherProvider(service.db, transport())
+    provider.configure(WeatherConfig(provider="open-meteo"))
+    service.renderer.weather = provider
+    snapshot = service.renderer.resolve("weather", {})
+    assert snapshot["forecast"][0]["maximum_c"] == 26
+    assert snapshot["weather_attribution"] == "Open-Meteo / CC BY 4.0"
+    assert service.renderer.render("weather", snapshot)