fix: merge main branch and renumber migration 027→037

Resolve 3 merge conflicts and renumber the automation_hooks migration
to follow main's migration chain (036_add_document_translation_fields).

Conflicts resolved:
- app/api/__init__.py: add automation_router alongside main's new routers
- app/utils/settings_service.py: add automation_hooks_enabled alongside compliance_enabled
- tests/conftest.py: add AutomationHook alongside AuditLog/ComplianceTemplate imports

Migration renumbered:
- 027_add_automation_hooks → 037_add_automation_hooks
- down_revision: 026_add_scheduled_jobs → 036_add_document_translation_fields

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

tests/test_api_user.py

@@ -14,18 +14,38 @@ class TestWhoamiHandler:
 
     @pytest.mark.asyncio
     async def test_returns_user_with_gravatar(self):
-        """Test that handler returns user data with gravatar URL."""
+        """Test that handler returns user data with gravatar URL when no custom avatar."""
         mock_request = MagicMock()
         email = "test@example.com"
         mock_request.session = {"user": {"id": "1", "email": email, "name": "Test"}}
 
-        result = await whoami_handler(mock_request)
+        # Mock DB: no UserProfile found (no custom avatar)
+        mock_db = MagicMock()
+        mock_db.query.return_value.filter.return_value.first.return_value = None
+
+        result = await whoami_handler(mock_request, mock_db)
         assert result["id"] == "1"
         assert result["name"] == "Test"
-        # Should have gravatar URL
+        # Should have gravatar URL since no custom avatar
         expected_hash = md5(email.encode(), usedforsecurity=False).hexdigest()
         assert result["picture"] == f"https://www.gravatar.com/avatar/{expected_hash}?d=identicon"
 
+    @pytest.mark.asyncio
+    async def test_returns_custom_avatar_when_set(self):
+        """Test that handler returns custom avatar URL when profile has avatar_data."""
+        mock_request = MagicMock()
+        email = "test@example.com"
+        mock_request.session = {"user": {"id": "1", "email": email, "name": "Test"}}
+
+        # Mock DB: UserProfile with avatar_data
+        mock_profile = MagicMock()
+        mock_profile.avatar_data = "data:image/png;base64,abc123"
+        mock_db = MagicMock()
+        mock_db.query.return_value.filter.return_value.first.return_value = mock_profile
+
+        result = await whoami_handler(mock_request, mock_db)
+        assert result["picture"] == "data:image/png;base64,abc123"
+
     @pytest.mark.asyncio
     async def test_raises_401_when_no_user(self):
         """Test that 401 is raised when no user in session."""
@@ -33,9 +53,10 @@ class TestWhoamiHandler:
 
         mock_request = MagicMock()
         mock_request.session = {}
+        mock_db = MagicMock()
 
         with pytest.raises(HTTPException) as exc_info:
-            await whoami_handler(mock_request)
+            await whoami_handler(mock_request, mock_db)
         assert exc_info.value.status_code == 401
 
     @pytest.mark.asyncio
@@ -45,11 +66,26 @@ class TestWhoamiHandler:
 
         mock_request = MagicMock()
         mock_request.session = {"user": {"id": "1", "name": "Test"}}
+        mock_db = MagicMock()
 
         with pytest.raises(HTTPException) as exc_info:
-            await whoami_handler(mock_request)
+            await whoami_handler(mock_request, mock_db)
         assert exc_info.value.status_code == 400
 
+    @pytest.mark.asyncio
+    async def test_falls_back_to_gravatar_on_db_error(self):
+        """Test that gravatar is used when DB lookup raises an exception."""
+        mock_request = MagicMock()
+        email = "test@example.com"
+        mock_request.session = {"user": {"id": "1", "email": email, "name": "Test"}}
+
+        mock_db = MagicMock()
+        mock_db.query.side_effect = Exception("DB error")
+
+        result = await whoami_handler(mock_request, mock_db)
+        expected_hash = md5(email.encode(), usedforsecurity=False).hexdigest()
+        assert result["picture"] == f"https://www.gravatar.com/avatar/{expected_hash}?d=identicon"
+
 
 @pytest.mark.integration
 class TestWhoamiEndpoints: