feat(auth): add local user signup, email verification, and Stripe billing

- Add LocalUser model with bcrypt password hashing, email verification
  tokens, and password reset tokens
- Add ALLOW_LOCAL_SIGNUP config flag (requires SMTP to be configured)
- Add Stripe billing config fields (STRIPE_SECRET_KEY, etc.)
- Add stripe_customer_id to UserProfile and stripe_price_id_monthly/
  stripe_price_id_yearly to SubscriptionPlan
- Create migration 018_add_local_users_and_billing
- Add app/utils/local_auth.py: hash_password, verify_password,
  generate_token, is_token_expired, send_verification_email,
  send_password_reset_email, build_session_user
- Add app/api/local_auth.py: signup, email verification, password reset
  endpoints plus signup/verify-email-sent/reset-password page routes
- Add app/api/billing.py: Stripe Checkout, Customer Portal, and webhook
  endpoints; syncs subscription tier from webhook events
- Update auth() to check LocalUser table before admin credentials fallback
- Update login() to pass allow_signup context variable to template
- Add signup.html, verify_email_sent.html, password_reset_form.html,
  billing_success.html templates (Alpine.js, Tailwind, WCAG 2.1 AA)
- Update login.html to show 'Create account' link when signup enabled
- Update pricing.html CTA buttons to use Stripe Checkout for paid tiers
- Add docs/BillingSetup.md with setup guide, webhook config, compliance
- Add tests/test_local_auth.py (42 tests) and tests/test_billing.py
  (31 tests); all 106 tests in the modified test suite pass
- Add stripe>=7.0.0,<15.0.0 to requirements.txt

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tests/test_auth.py

@@ -729,9 +729,16 @@ class TestEnsureUserProfile:
 class TestAuthFunction:
     """Tests for auth() function (local authentication)."""
 
+    def _make_mock_db(self):
+        """Create a mock DB that returns None for LocalUser queries (no local users)."""
+        mock_db = MagicMock()
+        # query().filter().first() returns None → no LocalUser found
+        mock_db.query.return_value.filter.return_value.first.return_value = None
+        return mock_db
+
     @pytest.mark.asyncio
     async def test_auth_success(self):
-        """Test successful local authentication."""
+        """Test successful local authentication (admin fallback)."""
         from app.auth import auth
 
         mock_request = MagicMock(spec=Request)
@@ -743,7 +750,7 @@ class TestAuthFunction:
             mock_settings.admin_username = "testadmin"
             mock_settings.admin_password = "testpass"
 
-            result = await auth(mock_request)
+            result = await auth(mock_request, db=self._make_mock_db())
 
             assert isinstance(result, RedirectResponse)
             assert result.status_code == 302
@@ -766,7 +773,7 @@ class TestAuthFunction:
             mock_settings.admin_username = "testadmin"
             mock_settings.admin_password = "testpass"
 
-            result = await auth(mock_request)
+            result = await auth(mock_request, db=self._make_mock_db())
 
             assert isinstance(result, RedirectResponse)
             assert "/login?error=Invalid+username+or+password" in result.headers["location"]
@@ -786,7 +793,7 @@ class TestAuthFunction:
             mock_settings.admin_username = "testadmin"
             mock_settings.admin_password = "testpass"
 
-            result = await auth(mock_request)
+            result = await auth(mock_request, db=self._make_mock_db())
 
             assert isinstance(result, RedirectResponse)
             assert "/login?error=Invalid+username+or+password" in result.headers["location"]
@@ -805,7 +812,7 @@ class TestAuthFunction:
             mock_settings.admin_username = "testadmin"
             mock_settings.admin_password = "testpass"
 
-            result = await auth(mock_request)
+            result = await auth(mock_request, db=self._make_mock_db())
 
             assert isinstance(result, RedirectResponse)
             assert result.headers["location"] == "/settings"