🔐 Auth smoke test