Fix CI failures: add backend/conftest.py for module resolution and run black formatting

- Add backend/conftest.py that inserts the backend directory into sys.path,
  fixing ModuleNotFoundError when pytest runs from the backend/ directory
  (as CI does with `cd backend && pytest tests/`)
- Run black formatter on all 28 backend files that needed reformatting
- All 53 tests pass with both `pytest tests/` and `python -m pytest tests/`

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/pop_puller_to_gmail/sessions/beb47db2-da25-416a-8fb0-c1452a3b22a7

backend/app/core/middleware.py

@@ -1,6 +1,7 @@
 """
 Security middleware for adding security headers and CSRF protection.
 """
+
 from fastapi import Request, Response
 from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.types import ASGIApp
@@ -9,24 +10,26 @@ import secrets
 
 class SecurityHeadersMiddleware(BaseHTTPMiddleware):
     """Add security headers to all responses"""
-    
+
     async def dispatch(self, request: Request, call_next) -> Response:
         response = await call_next(request)
-        
+
         # Prevent clickjacking
         response.headers["X-Frame-Options"] = "DENY"
-        
+
         # Prevent MIME type sniffing
         response.headers["X-Content-Type-Options"] = "nosniff"
-        
+
         # Enable XSS protection (for older browsers)
         response.headers["X-XSS-Protection"] = "1; mode=block"
-        
+
         # Strict Transport Security (HTTPS only)
         # Note: Only enable in production with HTTPS
         if request.url.hostname not in ["localhost", "127.0.0.1"]:
-            response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
-        
+            response.headers["Strict-Transport-Security"] = (
+                "max-age=31536000; includeSubDomains"
+            )
+
         # Content Security Policy (adjust based on frontend needs)
         csp = (
             "default-src 'self'; "
@@ -38,15 +41,15 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
             "frame-src https://js.stripe.com;"
         )
         response.headers["Content-Security-Policy"] = csp
-        
+
         # Referrer Policy
         response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
-        
+
         # Permissions Policy (formerly Feature Policy)
         response.headers["Permissions-Policy"] = (
             "geolocation=(), microphone=(), camera=()"
         )
-        
+
         return response
 
 
@@ -55,7 +58,7 @@ class CSRFProtectionMiddleware(BaseHTTPMiddleware):
     Basic CSRF protection for state-changing operations.
     For API-only applications, this is less critical but still good practice.
     """
-    
+
     def __init__(self, app: ASGIApp, exempt_paths: list = None):
         super().__init__(app)
         self.exempt_paths = exempt_paths or [
@@ -66,20 +69,20 @@ class CSRFProtectionMiddleware(BaseHTTPMiddleware):
             "/openapi.json",
             "/health",
         ]
-    
+
     async def dispatch(self, request: Request, call_next) -> Response:
         # Skip CSRF check for safe methods
         if request.method in ["GET", "HEAD", "OPTIONS"]:
             return await call_next(request)
-        
+
         # Skip CSRF check for exempt paths
         if any(request.url.path.startswith(path) for path in self.exempt_paths):
             return await call_next(request)
-        
+
         # For API endpoints using JWT, the token itself provides CSRF protection
         # This is because attackers can't access the token stored in httpOnly cookies
         # or local storage from a different origin
-        
+
         # If implementing cookie-based sessions, would check CSRF token here:
         # csrf_token = request.headers.get("X-CSRF-Token")
         # if not csrf_token or not self._validate_csrf_token(csrf_token):
@@ -87,15 +90,15 @@ class CSRFProtectionMiddleware(BaseHTTPMiddleware):
         #         status_code=403,
         #         content={"detail": "CSRF token missing or invalid"}
         #     )
-        
+
         response = await call_next(request)
         return response
-    
+
     @staticmethod
     def _generate_csrf_token() -> str:
         """Generate a secure CSRF token"""
         return secrets.token_urlsafe(32)
-    
+
     @staticmethod
     def _validate_csrf_token(token: str) -> bool:
         """Validate CSRF token (implement actual validation logic)"""