fix: kpi_causality无token测试对齐项目约定(403)

并发agent新增测试期望401, 与项目约定(test_reports: router级require_role→403)冲突
- 测试改为403(HTTPBearer默认行为即403)
- pytest 588 passed

backend/tests/test_kpi_causality.py

@@ -348,6 +348,6 @@ class TestPermissions:
         assert resp.status_code == 200
 
     def test_no_token_denied(self, client: TestClient):
-        """无token → 401（HTTPBearer 标准行为）"""
+        """无token → 403（router级 require_role 直接拒绝，与 test_reports 约定一致）"""
         resp = client.get(BASE)
-        assert resp.status_code == 401
+        assert resp.status_code == 403