feat(packs-lab): POST /api/packs/admin/mint-token 라우트 + 통합 테스트

MintTokenRequest/Response 스키마 추가, mint_token 라우트 구현 (HMAC 인증 + 확장자 검증 + JTI 발급), 테스트 3건 추가.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packs-lab/tests/test_routes.py

@@ -100,3 +100,39 @@ def test_list_success(mock_sb):
     r = client.get("/api/packs/list", headers=_signed(body))
     assert r.status_code == 200
     assert len(r.json()) == 1
+
+
+def test_mint_token_hmac_required():
+    """HMAC 헤더 누락 → 401."""
+    body = {"tier": "pro", "label": "샘플", "filename": "x.zip", "size_bytes": 1024}
+    resp = client.post("/api/packs/admin/mint-token", json=body)
+    assert resp.status_code == 401
+
+
+def test_mint_token_returns_valid_token():
+    """발급된 token이 verify_upload_token으로 통과해야 한다."""
+    from app.auth import verify_upload_token
+
+    body = {"tier": "pro", "label": "샘플", "filename": "test.zip", "size_bytes": 2048}
+    import json as _json
+    body_bytes = _json.dumps(body).encode()
+    resp = client.post("/api/packs/admin/mint-token", content=body_bytes, headers=_signed(body_bytes))
+    assert resp.status_code == 200
+    data = resp.json()
+    assert "token" in data and "expires_at" in data and "jti" in data
+
+    payload = verify_upload_token(data["token"])
+    assert payload["tier"] == "pro"
+    assert payload["label"] == "샘플"
+    assert payload["filename"] == "test.zip"
+    assert payload["size_bytes"] == 2048
+    assert payload["jti"] == data["jti"]
+
+
+def test_mint_token_invalid_filename():
+    """허용 외 확장자 → 400."""
+    body = {"tier": "pro", "label": "샘플", "filename": "x.exe", "size_bytes": 1024}
+    import json as _json
+    body_bytes = _json.dumps(body).encode()
+    resp = client.post("/api/packs/admin/mint-token", content=body_bytes, headers=_signed(body_bytes))
+    assert resp.status_code == 400