🧪 test: add comprehensive BDD test suite for user authentication

Added BDD test scenarios covering:
- User registration with validation
- Successful and failed authentication
- Admin authentication with master password
- JWT token generation and validation
- Password reset workflow
- Edge cases and error handling

BDD Features:
- 20+ authentication scenarios
- JWT validation edge cases
- Password reset security scenarios
- Input validation tests
- Error response verification

BDD Infrastructure:
- Step definitions for authentication workflows
- Test server with user management endpoints
- JWT parsing and validation utilities
- Common step patterns for reuse

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

pkg/bdd/steps/greet_steps.go

@@ -0,0 +1,66 @@
+package steps
+
+import (
+	"dance-lessons-coach/pkg/bdd/testserver"
+	"fmt"
+)
+
+// GreetSteps holds greet-related step definitions
+type GreetSteps struct {
+	client *testserver.Client
+}
+
+func NewGreetSteps(client *testserver.Client) *GreetSteps {
+	return &GreetSteps{client: client}
+}
+
+func (s *GreetSteps) RegisterSteps(ctx interface {
+	RegisterStep(string, interface{}) error
+}) error {
+	// This will be implemented in the main steps.go file
+	return nil
+}
+
+// Greet-related steps
+func (s *GreetSteps) iRequestAGreetingFor(name string) error {
+	return s.client.Request("GET", fmt.Sprintf("/api/v1/greet/%s", name), nil)
+}
+
+func (s *GreetSteps) iRequestTheDefaultGreeting() error {
+	return s.client.Request("GET", "/api/v1/greet/", nil)
+}
+
+func (s *GreetSteps) iSendPOSTRequestToV2GreetWithName(name string) error {
+	// Create JSON request body
+	requestBody := map[string]string{"name": name}
+	return s.client.Request("POST", "/api/v2/greet", requestBody)
+}
+
+func (s *GreetSteps) iSendPOSTRequestToV2GreetWithInvalidJSON(invalidJSON string) error {
+	// Send raw invalid JSON
+	return s.client.Request("POST", "/api/v2/greet", invalidJSON)
+}
+
+func (s *GreetSteps) theServerIsRunningWithV2Enabled() error {
+	// Verify the server is running and v2 is enabled by checking v2 endpoint exists
+	// First check server is running
+	if err := s.client.Request("GET", "/api/ready", nil); err != nil {
+		return err
+	}
+
+	// Check if v2 endpoint is available (should return 405 Method Not Allowed for GET, which means endpoint exists)
+	// If v2 is disabled, this will return 404
+	resp, err := s.client.CustomRequest("GET", "/api/v2/greet", nil)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	// If we get 405, v2 is enabled (endpoint exists but doesn't allow GET)
+	// If we get 404, v2 is disabled
+	if resp.StatusCode == 404 {
+		return fmt.Errorf("v2 endpoint not available - v2 feature flag not enabled")
+	}
+
+	return nil
+}