feat: finish forecast rendering and account-authenticated API explorer

tests/test_accounts.py

@@ -115,3 +115,13 @@ def test_reset_template(client):
         client.get("/api/v1/templates/quote").json()["defaults"]["title"]
         != "Saved title"
     )
+
+
+def test_openapi_describes_cookie_auth_and_docs_csrf(client):
+    schema = client.get("/openapi.json").json()
+    cookie = schema["components"]["securitySchemes"]["AccountSession"]
+    assert cookie["in"] == "cookie" and cookie["name"] == "frameflow_session"
+    assert {"AccountSession": []} in schema["paths"]["/api/v1/devices"]["get"][
+        "security"
+    ]
+    assert "X-CSRF-Token" in client.get("/docs").text