fix: resolve local dev issues found during first test run

- Replace passlib with bcrypt directly (passlib 1.7 incompatible with bcrypt 4.x)
- Fix SQLite engine config: disable pool_pre_ping, add check_same_thread=False
- Import all models in __init__.py so SQLAlchemy resolves relationships
- Change dev proxy port to 8001 (port 8000 occupied by Wacom service on dev machine)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/auth/password.py

@@ -1,15 +1,14 @@
 """
 GraphoLab Backend — Password hashing with bcrypt.
+Uses bcrypt directly (passlib 1.7 is incompatible with bcrypt 4.x).
 """
 
-from passlib.context import CryptContext
-
-_ctx = CryptContext(schemes=["bcrypt"], deprecated="auto")
+import bcrypt
 
 
 def hash_password(plain: str) -> str:
-    return _ctx.hash(plain)
+    return bcrypt.hashpw(plain.encode(), bcrypt.gensalt()).decode()
 
 
 def verify_password(plain: str, hashed: str) -> bool:
-    return _ctx.verify(plain, hashed)
+    return bcrypt.checkpw(plain.encode(), hashed.encode())

backend/database.py

@@ -9,11 +9,15 @@ from sqlalchemy.orm import DeclarativeBase
 
 from backend.config import settings
 
-engine = create_async_engine(
-    settings.database_url,
-    echo=settings.debug,
-    pool_pre_ping=True,
-)
+# SQLite needs check_same_thread=False; pool_pre_ping is not compatible with aiosqlite
+_is_sqlite = settings.database_url.startswith("sqlite")
+_engine_kwargs: dict = {"echo": settings.debug}
+if _is_sqlite:
+    _engine_kwargs["connect_args"] = {"check_same_thread": False}
+else:
+    _engine_kwargs["pool_pre_ping"] = True
+
+engine = create_async_engine(settings.database_url, **_engine_kwargs)
 
 AsyncSessionLocal = async_sessionmaker(
     bind=engine,

backend/models/__init__.py

@@ -0,0 +1,3 @@
+# Import all models so SQLAlchemy can resolve relationships regardless of import order.
+from backend.models.user import User, Organization, Role  # noqa: F401
+from backend.models.project import Project, Document, Analysis, ProjectStatus, AnalysisType  # noqa: F401

frontend/vite.config.ts

@@ -14,7 +14,7 @@ export default defineConfig({
     port: 3000,
     proxy: {
       '/api': {
-        target: 'http://localhost:8000',
+        target: 'http://localhost:8001',
         changeOrigin: true,
         rewrite: (p) => p.replace(/^\/api/, ''),
       },