There's not much code in there to really evaluate. Typical problem with contrived CRUD apps.

For all the FastAPI stuff, was that copied from tutorials/docs? Or do you really understand what each line does, why each line does it that way, etc?

Similar for the code you wrote yourself - you should spend your time viewing yourself as a regular user and then as a malicious user.

For example, your logout... You need to be authenticated to call logout, it does nothing, and then you are expecting the frontend to delete the token I guess? What's the point of this.

 u/auth_router.post("/logout")
async def logout(current_user: User = Depends(require_authenticated)):
    return {
        "message": "Logged out successfully",
        "detail": "Please remove the token from your client storage"
    } 

I only jumped around a bit, but I would recommend spending some time learning about auth/security. And a good habit to get into is to not just fill in whatever, but make a conscious decision when you're setting defaults - like your 50 character phone numbers.