fix: resolve logical errors, bugs, and security issues across codebase

- Fix is_admin() method shadowing is_admin database column in User model
- Fix check_password() crash when password_hash is None (OAuth-only users)
- Fix SystemSetting.all_settings() formatting error (missing newline)
- Fix MAIL_PORT returning string instead of int in config
- Fix AUTOMATION_TOKEN config formatting (missing newline before comment)
- Fix path traversal vulnerability in serve_user_audio using realpath validation
- Fix weak auth in process.py, replace session check with @login_required
- Fix int() crash on non-numeric priority in import_songs.py
- Add timeout to SMTP connection in email_helper.py
- Add timeouts to external API requests in metadata.py and spotify_helper.py
- Fix security tests to properly reload config module
- Fix metadata test mock data key mismatch (preview_url -> spotify_preview_url)
- Add skip decorator to integration test requiring live API credentials

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

tests/test_metadata.py

@@ -3,6 +3,7 @@ import sys
 import os
 import logging
 import dotenv
+import pytest
 from unittest.mock import patch, MagicMock
 
 # Add the project root to Python path for imports
@@ -91,7 +92,7 @@ class TestMetadataHelper(unittest.TestCase):
             "genre": ["Rock", "Hard Rock"],
             "spotify_id": "2zYzyRzz6pRmhPzyfMEC8s",
             "deezer_id": "89077521",
-            "preview_url": "https://audio-ssl.spotify.com/preview/track1234.mp3"
+            "spotify_preview_url": "https://audio-ssl.spotify.com/preview/track1234.mp3"
         }
         
         # Call function with test ISRC
@@ -203,6 +204,7 @@ class TestMetadataHelper(unittest.TestCase):
             self.assertEqual(metadata["year"], "1979")
             self.assertEqual(metadata["genre"], "hard rock")  # First tag from tag-list
 
+    @pytest.mark.skip(reason="Integration test requiring live API credentials. Run manually when needed.")
     def test_real_api_calls(self):
         """
         Test actual API calls with AC/DC's Highway to Hell.

tests/test_security.py

@@ -2,6 +2,7 @@
 import pytest
 import os
 import re
+import importlib
 
 
 class TestSecurityConfiguration:
@@ -14,14 +15,17 @@ class TestSecurityConfiguration:
         if secret_key:
             del os.environ['SECRET_KEY']
         
-        # Import should fail if SECRET_KEY not set
-        with pytest.raises(ValueError, match="SECRET_KEY environment variable must be set"):
-            from musicround.config import Config
-            _ = Config.SECRET_KEY
-        
-        # Restore environment
-        if secret_key:
-            os.environ['SECRET_KEY'] = secret_key
+        try:
+            # Force module reload to re-evaluate class-level checks
+            import musicround.config
+            with pytest.raises(ValueError, match="SECRET_KEY environment variable must be set"):
+                importlib.reload(musicround.config)
+        finally:
+            # Restore environment
+            if secret_key:
+                os.environ['SECRET_KEY'] = secret_key
+                # Reload with correct env so other tests work
+                importlib.reload(musicround.config)
     
     def test_automation_token_required(self):
         """Test that AUTOMATION_TOKEN must be set."""
@@ -30,14 +34,17 @@ class TestSecurityConfiguration:
         if token:
             del os.environ['AUTOMATION_TOKEN']
         
-        # Import should fail if AUTOMATION_TOKEN not set
-        with pytest.raises(ValueError, match="AUTOMATION_TOKEN environment variable must be set"):
-            from musicround.config import Config
-            _ = Config.AUTOMATION_TOKEN
-        
-        # Restore environment
-        if token:
-            os.environ['AUTOMATION_TOKEN'] = token
+        try:
+            # Force module reload to re-evaluate class-level checks
+            import musicround.config
+            with pytest.raises(ValueError, match="AUTOMATION_TOKEN environment variable must be set"):
+                importlib.reload(musicround.config)
+        finally:
+            # Restore environment
+            if token:
+                os.environ['AUTOMATION_TOKEN'] = token
+                # Reload with correct env so other tests work
+                importlib.reload(musicround.config)
     
     def test_no_credentials_in_code(self):
         """Test that no credentials are hardcoded in Python files."""