fix: resolve logical errors, bugs, and security issues across codebase

- Fix is_admin() method shadowing is_admin database column in User model
- Fix check_password() crash when password_hash is None (OAuth-only users)
- Fix SystemSetting.all_settings() formatting error (missing newline)
- Fix MAIL_PORT returning string instead of int in config
- Fix AUTOMATION_TOKEN config formatting (missing newline before comment)
- Fix path traversal vulnerability in serve_user_audio using realpath validation
- Fix weak auth in process.py, replace session check with @login_required
- Fix int() crash on non-numeric priority in import_songs.py
- Add timeout to SMTP connection in email_helper.py
- Add timeouts to external API requests in metadata.py and spotify_helper.py
- Fix security tests to properly reload config module
- Fix metadata test mock data key mismatch (preview_url -> spotify_preview_url)
- Add skip decorator to integration test requiring live API credentials

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

musicround/models.py

@@ -100,6 +100,8 @@ class User(db.Model, UserMixin):
 
     def check_password(self, password):
         """Check if provided password matches the hash"""
+        if not self.password_hash:
+            return False
         return check_password_hash(self.password_hash, password)
         
     def set_token(self):
@@ -111,8 +113,8 @@ class User(db.Model, UserMixin):
         """Check if user has a specific role"""
         return any(role.name == role_name for role in self.roles)
 
-    def is_admin(self):
-        """Check if user is an admin"""
+    def is_admin_by_role(self):
+        """Check if user is an admin via role assignment"""
         return self.has_role('admin')
         
     def __repr__(self):
@@ -323,7 +325,9 @@ class SystemSetting(db.Model):
             db.session.add(setting)
         else:
             setting.value = value
-        db.session.commit()    @staticmethod
+        db.session.commit()
+
+    @staticmethod
     def all_settings():
         return {s.key: s.value for s in SystemSetting.query.all()}