feat: SAC 0.7.4 sidebar system stats block with UI toggle

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_health.py

@@ -4,6 +4,6 @@ from app.version import APP_NAME, APP_VERSION, APP_VERSION_LABEL
 
 
 def test_version_constants():
-    assert APP_VERSION == "0.7.3"
+    assert APP_VERSION == "0.7.4"
     assert APP_NAME == "Security Alert Center"
-    assert APP_VERSION_LABEL == "Security Alert Center v.0.7.3"
+    assert APP_VERSION_LABEL == "Security Alert Center v.0.7.4"

backend/tests/test_system_stats.py

@@ -0,0 +1,30 @@
+"""GET /api/v1/system/stats"""
+
+from app.services.ui_settings import upsert_ui_settings
+
+
+def test_system_stats_requires_auth(client):
+    response = client.get("/api/v1/system/stats")
+    assert response.status_code == 401
+
+
+def test_system_stats_visible_default(jwt_headers, client):
+    response = client.get("/api/v1/system/stats", headers=jwt_headers)
+    assert response.status_code == 200
+    body = response.json()
+    assert body["visible"] is True
+    assert "collected_at" in body
+    assert "database" in body
+    assert body["database"]["status"] in ("ok", "error")
+    assert "app" in body
+    assert "events_last_hour" in body["app"]
+    assert "problems_open" in body["app"]
+
+
+def test_system_stats_respects_ui_setting(jwt_headers, client, db_session):
+    upsert_ui_settings(db_session, show_sidebar_system_stats=False)
+    db_session.commit()
+
+    response = client.get("/api/v1/system/stats", headers=jwt_headers)
+    assert response.status_code == 200
+    assert response.json()["visible"] is False

backend/tests/test_ui_settings.py

@@ -0,0 +1,32 @@
+"""GET/PUT /api/v1/settings/ui"""
+
+from app.models.ui_settings import UI_SETTINGS_ROW_ID, UiSettings
+
+
+def test_get_ui_settings_default(jwt_headers, client):
+    response = client.get("/api/v1/settings/ui", headers=jwt_headers)
+    assert response.status_code == 200
+    body = response.json()
+    assert body["show_sidebar_system_stats"] is True
+    assert body["source"] == "default"
+
+
+def test_put_ui_settings_persists(jwt_headers, client, db_session):
+    response = client.put(
+        "/api/v1/settings/ui",
+        headers=jwt_headers,
+        json={"show_sidebar_system_stats": False},
+    )
+    assert response.status_code == 200
+    body = response.json()
+    assert body["show_sidebar_system_stats"] is False
+    assert body["source"] == "db"
+
+    row = db_session.get(UiSettings, UI_SETTINGS_ROW_ID)
+    assert row is not None
+    assert row.show_sidebar_system_stats is False
+
+
+def test_ui_settings_requires_admin(jwt_monitor_headers, client):
+    response = client.get("/api/v1/settings/ui", headers=jwt_monitor_headers)
+    assert response.status_code == 403