fix: address code review feedback

- Use astimezone() instead of replace() for timezone conversion in is_token_expired
- Log cleanup exceptions with logger.exception() in signup
- Add security warning when STRIPE_WEBHOOK_SECRET is not configured
- Increase Stripe price ID column length from 64 to 128 characters
- Replace alert() with aria-live assertive region in pricing.html
- Convert auth() login tests to use pytest.mark.asyncio and await

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

app/utils/local_auth.py

@@ -46,7 +46,7 @@ def is_token_expired(sent_at: datetime | None) -> bool:
     """Return True when *sent_at* is None or older than TOKEN_EXPIRY_HOURS."""
     if sent_at is None:
         return True
-    return datetime.now(tz=timezone.utc) > sent_at.replace(tzinfo=timezone.utc) + timedelta(hours=TOKEN_EXPIRY_HOURS)
+    return datetime.now(tz=timezone.utc) > sent_at.astimezone(timezone.utc) + timedelta(hours=TOKEN_EXPIRY_HOURS)
 
 
 def _smtp_send(subject: str, html_body: str, plain_body: str, recipient: str) -> None: