feat(fio): check fio credentials on save and show the fio connection status

[jplacht]

What and why

The profile accepted any FIO API key and PrUn username. A wrong key or a typo failed silently in the Celery refresh (19 users, 670 fio_refresh_failed 401s in 14 days) and kept retrying. Saving FIO credentials now checks them against FIO right away, and the profile reports the real FIO state (none, syncing, ok, no data, key rejected, error).

Changes

• PATCH /user/profile/ verifies changed FIO credentials via FIO /auth (3 s). Errors are 400 field errors whose message is a stable code: fio_required, fio_invalid_key, fio_username_mismatch; the key owner's name is never returned. Clearing both disconnects without a call; FIO down or timing out still saves and logs fio_verify_unavailable.
• New throttle scope profile_update (10/min), on the update action only.
• Profile response gains fio_status and fio_last_refreshed_at (additive), derived from the new GameFIOPlayerData.fio_status_code (200 data, 204 no data yet, 401 key rejected).
• Refresh task: a 401 fails the row at once instead of retrying 10 times; a 204 from storage is "no data yet", not an error, and keeps the stored payload. New credentials reset the row as before.
• Migration 0024 adds the field; 0025 is a hand-written RunPython data migration (an exception to "migrations generated only", same pattern as gamedata/0005, 0023): rows without errors → 200, rows that last failed with a 401 → 401. Tested in tests/gamedata/migrations/.
• Admin: "FIO answer" list column, filter and header fact on FIO player data; the user page shows "FIO status (user sees)".
• Logs fio_verify_completed (result); the Axiom builder in the workspace repo has a matching panel.

How it was verified

QA PASS after three rounds (code review against the 11 acceptance criteria, full e2e walk in the running app with a real FIO account: wrong key, mismatch, missing field, valid pair Syncing → Active, rejected key, no data, admin pages). uv run ruff check, ruff format --check, ty check, pytest all pass.

Deploy order

Deploy backend first; it is backward compatible (new fields only; the current frontend already sends both FIO fields together). Paired frontend PR: PRUNplanner/frontend#542

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 32 complexity · 0 duplication

Metric	Results
Complexity	32
Duplication	0

View in Codacy

🟢 Coverage 98.98% diff coverage · +0.11% coverage variation

Metric	Results
Coverage variation	✅ +0.11% coverage variation (-1.00%)
Diff coverage	✅ 98.98% diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (bcee4cc)	4646	4435	95.46%
Head commit (41d1632)	4735 (+89)	4525 (+90)	95.56% (+0.11%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#68)	98	97	98.98%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}