fix(BA-7364): require the rate limit field on the auth response

A missing field defaulting to null reads as unlimited, so an incomplete
payload would silently disable the limit. Null stays a valid value — it is
what an unset limit means — but it now has to be sent explicitly.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jopemachine

src/ai/backend/common/dto/manager/auth/types.py

@@ -58,7 +58,7 @@ class AuthSuccessResponse(AuthResponse):
     status: str
     session_token: str
     user_id: UserID
-    rate_limit: int | None = None
+    rate_limit: int | None
     type: AuthTokenType = AuthTokenType.KEYPAIR
 
     def to_dict(self) -> dict[str, Any]:

tests/unit/client_v2/test_auth_client.py

@@ -82,6 +82,7 @@ async def test_authorize(self, sample_client_type_id: UUID) -> None:
                     "status": "active",
                     "session_token": "test_session_token",
                     "user_id": "12345678-1234-5678-1234-567812345678",
+                    "rate_limit": None,
                     "type": AuthTokenType.KEYPAIR,
                 },
             }

tests/unit/common/dto/manager/auth/test_auth_response.py

@@ -34,6 +34,7 @@ def test_authorize_response() -> None:
         status="active",
         session_token="test_session_token",
         user_id=UserID(uuid4()),
+        rate_limit=None,
         type=AuthTokenType.KEYPAIR,
     )
     resp = AuthorizeResponse(data=data)

tests/unit/common/dto/manager/auth/test_auth_types.py

@@ -45,6 +45,7 @@ def test_auth_success_response_creation() -> None:
         status="active",
         session_token="test_session_token",
         user_id=UserID(uuid4()),
+        rate_limit=None,
     )
     assert resp.access_key == "AKTEST"
     assert resp.secret_key == "SKTEST"
@@ -62,6 +63,7 @@ def test_auth_success_response_to_dict() -> None:
         status="active",
         session_token="test_session_token",
         user_id=UserID(uuid4()),
+        rate_limit=None,
         type=AuthTokenType.JWT,
     )
     d = resp.to_dict()
@@ -123,6 +125,7 @@ def test_parse_auth_response_success() -> None:
         "status": "active",
         "session_token": "test_token",
         "user_id": "12345678-1234-5678-1234-567812345678",
+        "rate_limit": None,
     }
     result = parse_auth_response(data)
     assert isinstance(result, AuthSuccessResponse)
@@ -159,6 +162,7 @@ def test_parse_auth_response_explicit_success() -> None:
         "status": "active",
         "session_token": "test_token",
         "user_id": "12345678-1234-5678-1234-567812345678",
+        "rate_limit": None,
     }
     result = parse_auth_response(data)
     assert isinstance(result, AuthSuccessResponse)