🧪 test: add failing BDD tests for user authentication system

Added comprehensive BDD feature file and step definitions for user authentication
following ADR-0018. All tests are failing as expected per TDD practice.

- Created features/user_authentication.feature with 7 scenarios
- Added 17 step definitions for authentication flows
- Tests cover: user auth, admin auth, registration, password reset
- All tests fail with descriptive error messages

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

pkg/bdd/steps/steps.go

@@ -31,6 +31,26 @@ func InitializeAllSteps(ctx *godog.ScenarioContext, client *testserver.Client) {
 	ctx.Step(`^I send a POST request to v2 greet with name "([^"]*)"$`, sc.iSendPOSTRequestToV2GreetWithName)
 	ctx.Step(`^I send a POST request to v2 greet with invalid JSON "([^"]*)"$`, sc.iSendPOSTRequestToV2GreetWithInvalidJSON)
 	ctx.Step(`^the response should contain error "([^"]*)"$`, sc.theResponseShouldContainError)
+
+	// User Authentication Steps
+	ctx.Step(`^a user "([^"]*)" exists with password "([^"]*)"$`, sc.aUserExistsWithPassword)
+	ctx.Step(`^I authenticate with username "([^"]*)" and password "([^"]*)"$`, sc.iAuthenticateWithUsernameAndPassword)
+	ctx.Step(`^the authentication should be successful$`, sc.theAuthenticationShouldBeSuccessful)
+	ctx.Step(`^I should receive a valid JWT token$`, sc.iShouldReceiveAValidJWTToken)
+	ctx.Step(`^the authentication should fail$`, sc.theAuthenticationShouldFail)
+	ctx.Step(`^I authenticate as admin with master password "([^"]*)"$`, sc.iAuthenticateAsAdminWithMasterPassword)
+	ctx.Step(`^the token should contain admin claims$`, sc.theTokenShouldContainAdminClaims)
+	ctx.Step(`^I register a new user "([^"]*)" with password "([^"]*)"$`, sc.iRegisterANewUserWithPassword)
+	ctx.Step(`^the registration should be successful$`, sc.theRegistrationShouldBeSuccessful)
+	ctx.Step(`^I should be able to authenticate with the new credentials$`, sc.iShouldBeAbleToAuthenticateWithTheNewCredentials)
+	ctx.Step(`^I am authenticated as admin$`, sc.iAmAuthenticatedAsAdmin)
+	ctx.Step(`^I request password reset for user "([^"]*)"$`, sc.iRequestPasswordResetForUser)
+	ctx.Step(`^the password reset should be allowed$`, sc.thePasswordResetShouldBeAllowed)
+	ctx.Step(`^the user should be flagged for password reset$`, sc.theUserShouldBeFlaggedForPasswordReset)
+	ctx.Step(`^I complete password reset for "([^"]*)" with new password "([^"]*)"$`, sc.iCompletePasswordResetForWithNewPassword)
+	ctx.Step(`^I should be able to authenticate with the new password$`, sc.iShouldBeAbleToAuthenticateWithTheNewPassword)
+	ctx.Step(`^a user "([^"]*)" exists and is flagged for password reset$`, sc.aUserExistsAndIsFlaggedForPasswordReset)
+	ctx.Step(`^the password reset should be successful$`, sc.thePasswordResetShouldBeSuccessful)
 }
 
 func (sc *StepContext) iRequestAGreetingFor(name string) error {
@@ -107,3 +127,94 @@ func (sc *StepContext) theResponseShouldContainError(expectedError string) error
 	}
 	return nil
 }
+
+// User Authentication Steps
+func (sc *StepContext) aUserExistsWithPassword(username, password string) error {
+	// This will need to be implemented when user management is available
+	return fmt.Errorf("user management not yet implemented")
+}
+
+func (sc *StepContext) iAuthenticateWithUsernameAndPassword(username, password string) error {
+	// This will need to be implemented when authentication endpoints are available
+	return fmt.Errorf("authentication not yet implemented")
+}
+
+func (sc *StepContext) theAuthenticationShouldBeSuccessful() error {
+	// This will need to be implemented when authentication is available
+	return fmt.Errorf("authentication not yet implemented")
+}
+
+func (sc *StepContext) iShouldReceiveAValidJWTToken() error {
+	// This will need to be implemented when JWT generation is available
+	return fmt.Errorf("JWT generation not yet implemented")
+}
+
+func (sc *StepContext) theAuthenticationShouldFail() error {
+	// This will need to be implemented when authentication is available
+	return fmt.Errorf("authentication not yet implemented")
+}
+
+func (sc *StepContext) iAuthenticateAsAdminWithMasterPassword(password string) error {
+	// This will need to be implemented when admin authentication is available
+	return fmt.Errorf("admin authentication not yet implemented")
+}
+
+func (sc *StepContext) theTokenShouldContainAdminClaims() error {
+	// This will need to be implemented when JWT claims are available
+	return fmt.Errorf("JWT claims not yet implemented")
+}
+
+func (sc *StepContext) iRegisterANewUserWithPassword(username, password string) error {
+	// This will need to be implemented when user registration is available
+	return fmt.Errorf("user registration not yet implemented")
+}
+
+func (sc *StepContext) theRegistrationShouldBeSuccessful() error {
+	// This will need to be implemented when user registration is available
+	return fmt.Errorf("user registration not yet implemented")
+}
+
+func (sc *StepContext) iShouldBeAbleToAuthenticateWithTheNewCredentials() error {
+	// This will need to be implemented when authentication is available
+	return fmt.Errorf("authentication not yet implemented")
+}
+
+func (sc *StepContext) iAmAuthenticatedAsAdmin() error {
+	// This will need to be implemented when admin authentication is available
+	return fmt.Errorf("admin authentication not yet implemented")
+}
+
+func (sc *StepContext) iRequestPasswordResetForUser(username string) error {
+	// This will need to be implemented when password reset is available
+	return fmt.Errorf("password reset not yet implemented")
+}
+
+func (sc *StepContext) thePasswordResetShouldBeAllowed() error {
+	// This will need to be implemented when password reset is available
+	return fmt.Errorf("password reset not yet implemented")
+}
+
+func (sc *StepContext) theUserShouldBeFlaggedForPasswordReset() error {
+	// This will need to be implemented when password reset is available
+	return fmt.Errorf("password reset not yet implemented")
+}
+
+func (sc *StepContext) iCompletePasswordResetForWithNewPassword(username, password string) error {
+	// This will need to be implemented when password reset is available
+	return fmt.Errorf("password reset not yet implemented")
+}
+
+func (sc *StepContext) aUserExistsAndIsFlaggedForPasswordReset(username string) error {
+	// This will need to be implemented when password reset is available
+	return fmt.Errorf("password reset not yet implemented")
+}
+
+func (sc *StepContext) thePasswordResetShouldBeSuccessful() error {
+	// This will need to be implemented when password reset is available
+	return fmt.Errorf("password reset not yet implemented")
+}
+
+func (sc *StepContext) iShouldBeAbleToAuthenticateWithTheNewPassword() error {
+	// This will need to be implemented when authentication is available
+	return fmt.Errorf("authentication not yet implemented")
+}