fix: address code review feedback

- Use astimezone() instead of replace() for timezone conversion in is_token_expired
- Log cleanup exceptions with logger.exception() in signup
- Add security warning when STRIPE_WEBHOOK_SECRET is not configured
- Increase Stripe price ID column length from 64 to 128 characters
- Replace alert() with aria-live assertive region in pricing.html
- Convert auth() login tests to use pytest.mark.asyncio and await

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

app/api/billing.py

@@ -238,6 +238,11 @@ async def stripe_webhook(request: Request, db: Session = Depends(get_db)) -> dic
         if settings.stripe_webhook_secret:
             event = stripe.Webhook.construct_event(payload, sig_header, settings.stripe_webhook_secret)
         else:
+            logger.warning(
+                "[SECURITY] STRIPE_WEBHOOK_SECRET is not configured. "
+                "Webhook events are accepted without signature verification. "
+                "Set STRIPE_WEBHOOK_SECRET in production to prevent spoofed events."
+            )
             event = stripe.Event.construct_from(json.loads(payload), stripe.api_key)
     except stripe.SignatureVerificationError:
         logger.warning("[SECURITY] Stripe webhook signature verification failed")

app/api/local_auth.py

@@ -187,6 +187,7 @@ async def signup(request: Request, body: SignupBody, db: DbSession) -> dict[str,
             db.commit()
         except Exception:
             db.rollback()
+            logger.exception("Failed to clean up orphan records for %s after email send failure", body.email)
         logger.warning("Signup email failed for %s: %s", body.email, exc)
         raise HTTPException(
             status_code=status.HTTP_503_SERVICE_UNAVAILABLE,

app/models.py

@@ -288,8 +288,8 @@ class SubscriptionPlan(Base):
     sort_order = Column(Integer, nullable=False, default=0)
     features = Column(Text, nullable=True)  # JSON-encoded list[str]
     api_access = Column(Boolean, nullable=False, default=False)
-    stripe_price_id_monthly = Column(String(64), nullable=True)
-    stripe_price_id_yearly = Column(String(64), nullable=True)
+    stripe_price_id_monthly = Column(String(128), nullable=True)
+    stripe_price_id_yearly = Column(String(128), nullable=True)
 
     created_at = Column(DateTime(timezone=True), server_default=func.now())
     updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now())

app/utils/local_auth.py

@@ -46,7 +46,7 @@ def is_token_expired(sent_at: datetime | None) -> bool:
     """Return True when *sent_at* is None or older than TOKEN_EXPIRY_HOURS."""
     if sent_at is None:
         return True
-    return datetime.now(tz=timezone.utc) > sent_at.replace(tzinfo=timezone.utc) + timedelta(hours=TOKEN_EXPIRY_HOURS)
+    return datetime.now(tz=timezone.utc) > sent_at.astimezone(timezone.utc) + timedelta(hours=TOKEN_EXPIRY_HOURS)
 
 
 def _smtp_send(subject: str, html_body: str, plain_body: str, recipient: str) -> None: