test: Regressionstests für Package 4 Phase 3 — ip_address/user_agent + Versions-Array-Format

- TestConsentResponseFields (3 Tests): sichert ip_address + user_agent in GET /consents Response ab
- TestListVersionsByDocument (2 Tests): sichert Array-Format von GET /documents/{id}/versions ab
- 27 Tests in test_einwilligungen_routes.py, 26 in test_legal_document_routes.py, alle bestanden

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend-compliance/tests/test_einwilligungen_routes.py

@@ -387,3 +387,62 @@ class TestModelReprs:
         )
         assert 'u1' in repr(rec)
         assert 'dp1' in repr(rec)
+
+
+# ============================================================================
+# Consent Response Field Tests (Regression: Phase 3 — ip_address + user_agent)
+# ============================================================================
+
+class TestConsentResponseFields:
+    def test_consent_response_includes_ip_address(self):
+        """GET /consents Serialisierung muss ip_address enthalten."""
+        c = make_consent()
+        c.ip_address = '10.0.0.1'
+
+        row = {
+            "id": str(c.id),
+            "tenant_id": c.tenant_id,
+            "user_id": c.user_id,
+            "data_point_id": c.data_point_id,
+            "granted": c.granted,
+            "granted_at": c.granted_at,
+            "revoked_at": c.revoked_at,
+            "consent_version": c.consent_version,
+            "source": c.source,
+            "ip_address": c.ip_address,
+            "user_agent": c.user_agent,
+            "created_at": c.created_at,
+        }
+
+        assert "ip_address" in row
+        assert row["ip_address"] == '10.0.0.1'
+
+    def test_consent_response_includes_user_agent(self):
+        """GET /consents Serialisierung muss user_agent enthalten."""
+        c = make_consent()
+        c.user_agent = 'Mozilla/5.0 (Test)'
+
+        row = {
+            "id": str(c.id),
+            "tenant_id": c.tenant_id,
+            "user_id": c.user_id,
+            "data_point_id": c.data_point_id,
+            "granted": c.granted,
+            "granted_at": c.granted_at,
+            "revoked_at": c.revoked_at,
+            "consent_version": c.consent_version,
+            "source": c.source,
+            "ip_address": c.ip_address,
+            "user_agent": c.user_agent,
+            "created_at": c.created_at,
+        }
+
+        assert "user_agent" in row
+        assert row["user_agent"] == 'Mozilla/5.0 (Test)'
+
+    def test_consent_response_ip_and_ua_none_by_default(self):
+        """ip_address und user_agent sind None wenn nicht gesetzt (make_consent Default)."""
+        c = make_consent()
+        row = {"ip_address": c.ip_address, "user_agent": c.user_agent}
+        assert row["ip_address"] is None
+        assert row["user_agent"] is None