test: add test suite with 65 tests, 73% coverage

- Unit tests: password hashing, notification providers, webhook field parsing
- Integration tests: auth routes (register/login/confirm-email/logout),
  invite flow, Evotor webhooks (/user/create, /user/verify, /user/token),
  admin panel (access control, activate/suspend/delete/reset-password)
- conftest: SQLite in-memory engine, transactional sessions, factory-boy
  factories (UserFactory with UserRoleEnum variants)
- Fix bcrypt: replace passlib (broken on Python 3.14 + bcrypt 5.x) with
  direct bcrypt calls; drop passlib from requirements.txt
- Fix datetime.utcnow() deprecation across routes and tests
- Fix Jinja2 TemplateResponse signature (request as first positional arg)
- Add coverage config to pyproject.toml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/routes/reset.py

@@ -1,5 +1,5 @@
 import secrets
-from datetime import datetime, timedelta
+from datetime import datetime, timezone, timedelta
 
 from fastapi import APIRouter, Depends, Request
 from fastapi.responses import HTMLResponse, RedirectResponse
@@ -18,7 +18,7 @@ router = APIRouter()
 def _render(request: Request, template: str, ctx: dict) -> HTMLResponse:
     ctx["request"] = request
     ctx.setdefault("jivosite_widget_id", settings.JIVOSITE_WIDGET_ID)
-    return templates.TemplateResponse(template, ctx)
+    return templates.TemplateResponse(ctx.pop("request"), template, ctx)
 
 
 @router.get("/forgot-password")
@@ -34,7 +34,7 @@ async def forgot_post(request: Request, db: Session = Depends(get_db)):
     if user:
         token = secrets.token_urlsafe(32)
         user.password_reset_token = token
-        user.password_reset_expires = datetime.utcnow() + timedelta(
+        user.password_reset_expires = datetime.now(timezone.utc).replace(tzinfo=None) + timedelta(
             minutes=settings.PASSWORD_RESET_EXPIRE_MINUTES
         )
         db.commit()
@@ -54,7 +54,7 @@ async def forgot_post(request: Request, db: Session = Depends(get_db)):
 async def reset_get(request: Request, db: Session = Depends(get_db)):
     token = request.query_params.get("token", "")
     user = db.query(User).filter(User.password_reset_token == token).first()
-    if not user or not user.password_reset_expires or user.password_reset_expires < datetime.utcnow():
+    if not user or not user.password_reset_expires or user.password_reset_expires < datetime.now(timezone.utc).replace(tzinfo=None):
         return _render(request, "message.html", {
             "user": None, "title": "Ссылка недействительна",
             "message": "Ссылка для сброса пароля устарела или недействительна.",
@@ -72,7 +72,7 @@ async def reset_post(request: Request, db: Session = Depends(get_db)):
     errors = []
 
     user = db.query(User).filter(User.password_reset_token == token).first()
-    if not user or not user.password_reset_expires or user.password_reset_expires < datetime.utcnow():
+    if not user or not user.password_reset_expires or user.password_reset_expires < datetime.now(timezone.utc).replace(tzinfo=None):
         return _render(request, "message.html", {
             "user": None, "title": "Ссылка недействительна",
             "message": "Ссылка для сброса пароля устарела.",