fix: resolve logical errors, bugs, and security issues across codebase

- Fix is_admin() method shadowing is_admin database column in User model
- Fix check_password() crash when password_hash is None (OAuth-only users)
- Fix SystemSetting.all_settings() formatting error (missing newline)
- Fix MAIL_PORT returning string instead of int in config
- Fix AUTOMATION_TOKEN config formatting (missing newline before comment)
- Fix path traversal vulnerability in serve_user_audio using realpath validation
- Fix weak auth in process.py, replace session check with @login_required
- Fix int() crash on non-numeric priority in import_songs.py
- Add timeout to SMTP connection in email_helper.py
- Add timeouts to external API requests in metadata.py and spotify_helper.py
- Fix security tests to properly reload config module
- Fix metadata test mock data key mismatch (preview_url -> spotify_preview_url)
- Add skip decorator to integration test requiring live API credentials

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

musicround/helpers/spotify_helper.py

@@ -26,7 +26,7 @@ def refresh_spotify_token(refresh_token):
         'client_secret': client_secret
     }
     
-    response = requests.post('https://accounts.spotify.com/api/token', data=data)
+    response = requests.post('https://accounts.spotify.com/api/token', data=data, timeout=10)
     
     if response.status_code == 200:
         return response.json()
@@ -181,7 +181,7 @@ def get_spotify_user_info(access_token):
     }
     
     try:
-        response = requests.get('https://api.spotify.com/v1/me', headers=headers)
+        response = requests.get('https://api.spotify.com/v1/me', headers=headers, timeout=10)
         
         if response.status_code == 200:
             return response.json()