fix(backend): Kimi OAuth 请求级 httpx 客户端改生成器依赖修泄漏（CR-H2）

apps/api/tests/test_kimi_oauth_endpoints.py

@@ -150,7 +150,8 @@ def _make_client(
     app.dependency_overrides[get_job_repo] = lambda: job_repo
     app.dependency_overrides[get_session] = lambda: FakeSession()
     app.dependency_overrides[get_session_factory] = lambda: sf
-    app.dependency_overrides[routers.kimi_oauth._default_http_client] = lambda: http
+    # 请求级 http 现为生成器依赖 `_http_client`（CR-H2）——override 它注 fake（否则真生成器联网）。
+    app.dependency_overrides[routers.kimi_oauth._http_client] = lambda: http
     return TestClient(app)
 
 
@@ -263,6 +264,47 @@ def test_poll_loop_does_not_hold_db_session(monkeypatch: pytest.MonkeyPatch) ->
     assert "secret-ref" not in resp.text
 
 
+async def test_http_client_dependency_is_generator_and_closes_client(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """CR-H2：请求级 `_http_client` 是**生成器依赖**，请求结束时 aclose 客户端（不泄漏连接）。
+
+    驱动生成器一轮（enter→yield→exit），断言：是 async 生成器；yield 时未关闭；耗尽时恰好
+    关闭一次。RED：修复前 `_http_client` 不存在（AttributeError）。
+    """
+    import inspect
+
+    from ww_api.routers import kimi_oauth
+
+    closes = {"count": 0}
+
+    class _SpyClient:
+        def __init__(self, *args: Any, **kwargs: Any) -> None:
+            pass
+
+        async def __aenter__(self) -> _SpyClient:
+            return self
+
+        async def __aexit__(self, *exc: Any) -> None:
+            closes["count"] += 1
+
+        async def aclose(self) -> None:
+            closes["count"] += 1
+
+    monkeypatch.setattr("ww_api.routers.kimi_oauth.httpx.AsyncClient", _SpyClient)
+
+    # 是 async 生成器依赖（有 teardown），非普通函数（普通函数依赖无 teardown → 泄漏）。
+    assert inspect.isasyncgenfunction(kimi_oauth._http_client)
+
+    gen = kimi_oauth._http_client()
+    client = await gen.__anext__()
+    assert client is not None
+    assert closes["count"] == 0  # yield 时尚未关闭
+    with pytest.raises(StopAsyncIteration):
+        await gen.__anext__()
+    assert closes["count"] == 1  # 请求结束恰好关闭一次
+
+
 def test_disconnect_clears_credential(monkeypatch: pytest.MonkeyPatch) -> None:
     enc_key = Fernet.generate_key().decode()
     store = FakeCredentialStore()