fix: merge main branch and renumber migration 027→037

Resolve 3 merge conflicts and renumber the automation_hooks migration
to follow main's migration chain (036_add_document_translation_fields).

Conflicts resolved:
- app/api/__init__.py: add automation_router alongside main's new routers
- app/utils/settings_service.py: add automation_hooks_enabled alongside compliance_enabled
- tests/conftest.py: add AutomationHook alongside AuditLog/ComplianceTemplate imports

Migration renumbered:
- 027_add_automation_hooks → 037_add_automation_hooks
- down_revision: 026_add_scheduled_jobs → 036_add_document_translation_fields

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

tests/test_local_auth.py

@@ -613,6 +613,8 @@ async def test_local_login_success(la_session, active_user):
     mock_request = MagicMock(spec=Request)
     mock_request.form = AsyncMock(return_value={"username": "activeuser", "password": "password123"})
     mock_request.session = {}
+    mock_request.headers.get.return_value = None
+    mock_request.client = None
 
     result = await auth(mock_request, db=la_session)
     assert result.status_code == 302
@@ -634,6 +636,8 @@ async def test_local_login_by_email(la_session, active_user):
     mock_request = MagicMock(spec=Request)
     mock_request.form = AsyncMock(return_value={"username": "active@example.com", "password": "password123"})
     mock_request.session = {}
+    mock_request.headers.get.return_value = None
+    mock_request.client = None
 
     result = await auth(mock_request, db=la_session)
     assert result.status_code == 302
@@ -747,6 +751,85 @@ async def test_single_user_mode_skips_local_user_table(la_session, active_user):
     assert mock_request.session["user"]["id"] == "admin"
 
 
+# ---------------------------------------------------------------------------
+# Case-insensitive login
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.unit
+@pytest.mark.asyncio
+@patch.object(settings, "multi_user_enabled", True)
+async def test_local_login_username_case_insensitive(la_session, active_user):
+    """auth() accepts username with different casing (e.g. 'ActiveUser' for 'activeuser')."""
+    from unittest.mock import AsyncMock, MagicMock
+
+    from fastapi import Request
+
+    from app.auth import auth
+
+    mock_request = MagicMock(spec=Request)
+    mock_request.form = AsyncMock(return_value={"username": "ActiveUser", "password": "password123"})
+    mock_request.session = {}
+    mock_request.headers.get.return_value = None
+    mock_request.client = None
+
+    result = await auth(mock_request, db=la_session)
+    assert result.status_code == 302
+    assert "user" in mock_request.session
+    assert mock_request.session["user"]["email"] == "active@example.com"
+
+
+@pytest.mark.unit
+@pytest.mark.asyncio
+@patch.object(settings, "multi_user_enabled", True)
+async def test_local_login_email_case_insensitive(la_session, active_user):
+    """auth() accepts email with different casing (e.g. 'Active@Example.com' for 'active@example.com')."""
+    from unittest.mock import AsyncMock, MagicMock
+
+    from fastapi import Request
+
+    from app.auth import auth
+
+    mock_request = MagicMock(spec=Request)
+    mock_request.form = AsyncMock(return_value={"username": "Active@Example.com", "password": "password123"})
+    mock_request.session = {}
+    mock_request.headers.get.return_value = None
+    mock_request.client = None
+
+    result = await auth(mock_request, db=la_session)
+    assert result.status_code == 302
+    assert "user" in mock_request.session
+    assert mock_request.session["user"]["email"] == "active@example.com"
+
+
+@pytest.mark.unit
+@pytest.mark.asyncio
+async def test_admin_login_username_case_insensitive():
+    """auth() admin credential check is case-insensitive for username."""
+    from unittest.mock import AsyncMock, MagicMock, patch
+
+    from fastapi import Request
+
+    from app.auth import auth
+
+    mock_request = MagicMock(spec=Request)
+    mock_request.form = AsyncMock(return_value={"username": "ADMIN", "password": "adminpass"})
+    mock_request.session = {}
+    mock_request.headers.get.return_value = None
+    mock_request.client = None
+
+    with patch("app.auth.settings") as mock_settings:
+        mock_settings.admin_username = "admin"
+        mock_settings.admin_password = "adminpass"
+        mock_settings.multi_user_enabled = False
+
+        result = await auth(mock_request, db=MagicMock())
+
+    assert result.status_code == 302
+    assert "user" in mock_request.session
+    assert mock_request.session["user"]["is_admin"] is True
+
+
 # ---------------------------------------------------------------------------
 # Integration tests: admin local user management
 # ---------------------------------------------------------------------------