Email delivery: - Replaced logging-only email sender with aiosmtplib SMTP implementation. - Added provider mode switch via EMAIL_PROVIDER (log/smtp). - Added TLS/SSL and timeout controls for SMTP transport. Auth registration flow: - Made register/resend/reset email flows transactional with rollback on delivery failure. - Return 503 when verification/reset email cannot be delivered. Configuration: - Extended settings and env templates for EMAIL_PROVIDER, SMTP_USE_SSL, SMTP_TIMEOUT_SECONDS. - Updated docker-compose environment mapping for new SMTP variables.
Security hardening: - Added IP/user rate limiting with Redis-backed counters and fail-open behavior. - Added message anti-spam controls (per-chat rate + duplicate cooldown). - Implemented refresh token rotation with JTI tracking and revoke support. Notification pipeline: - Added Celery app and async notification tasks for mention/offline delivery. - Added Redis-based presence tracking and integrated it into realtime connect/disconnect. - Added notification dispatch from message flow and notifications listing endpoint. Quality gates and CI: - Added pytest async integration tests for auth and chat/message lifecycle. - Added pytest config, test fixtures, and GitHub Actions CI workflow. - Fixed bcrypt/passlib compatibility by pinning bcrypt version. - Documented worker and quality-gate commands in README.