fix: merge main, address code review feedback for security fix PR #816

- Merge origin/main into branch (resolve conflict in integrations_dashboard.html)
- Add defensive JSON parsing with try/except for integration.config
- Wrap tester() call in try/except to prevent 500 errors from bad config
- Add i18n key integrations.connection_test_failed_fallback in en.json
- Reference i18n key in template JS fallback message
- Update SECURITY_AUDIT.md: add fix date (2026-03-23), update doc date
- Remove accidental revert.sh file
- Fix missing MagicMock/patch imports in test file
- Add tests for invalid JSON config and tester exception error paths

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/daebb70e-059a-4601-8864-88eef49f99cf

tests/test_local_auth.py

@@ -322,6 +322,35 @@ def test_signup_duplicate_username(la_client, active_user):
     assert "Username" in resp.json()["detail"]
 
 
+@pytest.mark.integration
+def test_signup_invalid_username_with_dot(la_client):
+    """POST /api/auth/signup returns 422 with a list detail when username contains a dot.
+
+    This is a regression test for the bug where ``data.detail`` was an array,
+    causing the frontend to display ``[object Object]`` instead of a message.
+    """
+    with patch("app.api.local_auth.settings") as mock_settings:
+        mock_settings.allow_local_signup = True
+        mock_settings.multi_user_enabled = True
+        mock_settings.email_host = "smtp.example.com"
+        resp = la_client.post(
+            "/api/auth/signup",
+            json={
+                "email": "a@example.com",
+                "username": "christian.louis",
+                "password": "password1",
+                "password_confirm": "password1",
+            },
+        )
+    assert resp.status_code == 422
+    detail = resp.json()["detail"]
+    # FastAPI returns a list of validation errors for Pydantic constraint failures.
+    # Each entry must be a dict with a "msg" key so the frontend can extract a readable message.
+    assert isinstance(detail, list), "detail should be a list for Pydantic validation errors"
+    assert len(detail) > 0
+    assert "msg" in detail[0]
+
+
 @pytest.mark.integration
 def test_signup_smtp_failure_cleans_up(la_client, la_session):
     """POST /api/auth/signup cleans up user records if email send fails."""