refactor: hoist Project import to top; drop unused test import

backend/portal_auth.py

@@ -27,7 +27,7 @@ from fastapi import Request, Depends
 from sqlalchemy.orm import Session
 
 from backend.database import get_db
-from backend.models import Client, ClientAccessToken
+from backend.models import Client, ClientAccessToken, Project
 
 logger = logging.getLogger(__name__)
 
@@ -188,8 +188,6 @@ def provision_preview_session(project, db) -> str:
 # owning exactly that project, so the existing client-scoped routes are automatically
 # per-project. Project.client_id is left untouched (deferred per-client rollup).
 
-from backend.models import Project  # local import; Project not needed above
-
 
 def portal_client_for_project(project, db) -> Client:
     """Get-or-create the dedicated 1:1 portal client for a project."""

tests/test_portal_auth_helpers.py

@@ -2,7 +2,6 @@ import time
 from tests.conftest import make_project
 from backend import portal_auth as pa
 from backend.models import Client, ClientAccessToken
-from backend.auth_passwords import hash_password
 
 
 def test_portal_client_for_project_is_1to1_and_idempotent(db_session):