add unit tests for user and auth

backend/tests/Unit/Auth/UseCases/CreateSessionTest.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace Tests\Unit\Auth\UseCases;
+
+use App\Auth\Clock;
+use App\Auth\TokenGenerator;
+use App\Auth\UseCases\CreateSession\CreateSession;
+use App\Shared\ValueObject\EmailAddress;
+use App\User\User;
+use DateTimeImmutable;
+use PHPUnit\Framework\TestCase;
+use Tests\Fakes\FakeSessionRepository;
+
+class CreateSessionTest extends TestCase
+{
+    private FakeSessionRepository $sessionRepo;
+    private TokenGenerator $tokenGenerator;
+    private Clock $clock;
+    private CreateSession $createSession;
+
+    protected function setUp(): void
+    {
+        $this->sessionRepo = new FakeSessionRepository();
+        $this->tokenGenerator = new class implements TokenGenerator {
+            public function generate(): string
+            {
+                return 'fake-token-123';
+            }
+        };
+        $this->clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-05-18 12:00:00', new \DateTimeZone('UTC'));
+            }
+        };
+
+        $this->createSession = new CreateSession($this->sessionRepo, $this->tokenGenerator, $this->clock);
+    }
+
+    public function testCreatesSessionForUser(): void
+    {
+        $email = new EmailAddress('user@example.com');
+        $user = new User(1, $email, 'hashed-password');
+
+        $session = $this->createSession->execute($user);
+
+        $this->assertSame('fake-token-123', $session->getToken());
+        $this->assertSame($user, $session->getUser());
+        $this->assertFalse($session->isExpired($this->clock->now()));
+    }
+}