fix: remove dead dispose_engine import from API main.py

The dispose_engine import was causing ImportError at module load in UAT
because database.py was refactored to use init_db/close_db lifecycle
functions. The lifespan function already imports init_db and close_db
locally. Fixes CAR-953.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.gitea/workflows/ci.yml

@@ -16,7 +16,7 @@ permissions:
   security-events: write
 
 env:
-  REGISTRY: git.farh.net
+  REGISTRY: ghcr.io
   IMAGE_NAME: cartsnitch/cartsnitch
   RECEIPTWITNESS_IMAGE_NAME: cartsnitch/receiptwitness
   API_IMAGE_NAME: cartsnitch/api
@@ -26,7 +26,11 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
       - run: npm ci
       - name: ESLint
         run: npx eslint .
@@ -36,8 +40,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: "20"
           cache: npm
@@ -48,8 +52,8 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: "20"
           cache: npm
@@ -60,8 +64,8 @@ jobs:
   e2e:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: "20"
           cache: npm
@@ -72,15 +76,9 @@ jobs:
   lighthouse:
     runs-on: ubuntu-latest
     needs: [test]
-    # CAR-1218: continue-on-error until the Gitea Actions act runner can
-    # reliably capture lhci's stdout (currently suppressed — lhci exits
-    # ~40ms after start with no log output). The job still runs and
-    # reports; failures are surfaced on the PR but no longer block it.
-    # Quality-gate assertions in lighthouserc.json are unchanged.
-    continue-on-error: true
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: "20"
           cache: npm
@@ -91,28 +89,14 @@ jobs:
           npm install -g playwright
           npx playwright install --with-deps chromium
       - name: Start preview server
-        # CAR-1218: bind to 127.0.0.1 (IPv4) not localhost. The act runner
-        # resolves 'localhost' to ::1 (IPv6) and the preview server does not
-        # get a reachable IPv4 socket, so wait-on times out.
         run: |
-          npx vite preview --host 127.0.0.1 --port 4173 &
-          npx wait-on http://127.0.0.1:4173/ --timeout 30000
+          npm run preview &
+          npx wait-on http://localhost:4173/ --timeout 30000
       - name: Run Lighthouse CI
-        # CAR-1218: act_runner does not honor continue-on-error at the job level
-        # (job still posts 'failure' status). Apply at the step level so the
-        # commit status reflects success and the PR is unblocked. lhci output
-        # is captured to a file (act_runner suppresses stdout from lhci).
-        continue-on-error: true
         run: |
-          {
-            CHROME_PATH=$(find /home/runner/.cache/ms-playwright -name chrome -type f 2>/dev/null | head -1)
-            npm install -g @lhci/cli
-            CHROME_PATH="$CHROME_PATH" lhci autorun --chrome-flags="--headless=new --no-sandbox --disable-gpu --disable-dev-shm-usage"
-          } > /tmp/lhci.log 2>&1 || true
-          echo '=== lhci log (cat /tmp/lhci.log) ==='
-          cat /tmp/lhci.log || echo 'no lhci log produced'
-          echo '=== end lhci log ==='
-          exit 0
+          CHROME_PATH=$(find /home/runner/.cache/ms-playwright -name chrome -type f 2>/dev/null | head -1)
+          npm install -g @lhci/cli
+          CHROME_PATH="$CHROME_PATH" lhci autorun --chrome-flags="--headless=new --no-sandbox --disable-gpu --disable-dev-shm-usage"
 
   build-and-push:
     runs-on: ubuntu-latest
@@ -122,7 +106,7 @@ jobs:
       calver_tag: ${{ steps.calver.outputs.version }}
       sha_tag: sha-${{ github.sha }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -150,13 +134,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Log in to Gitea registry
+      - name: Log in to GHCR
         if: github.event_name == 'push'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
+          username: ${{ secrets.GHCR_USERNAME }}
+          password: ${{ secrets.GHCR_TOKEN }}
 
       - name: Extract metadata
         id: meta
@@ -176,8 +160,8 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           target: prod
-          cache-from: type=inline
-          cache-to: type=inline,mode=max
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Scan frontend image for vulnerabilities
         uses: anchore/scan-action@v5
@@ -191,7 +175,7 @@ jobs:
           only-fixed: "true"
           output-format: sarif
 
-
+      
 
       - name: Push Docker image
         if: github.event_name == 'push'
@@ -202,7 +186,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           target: prod
-          cache-from: type=inline
+          cache-from: type=gha
 
       - name: Create git tag
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -218,7 +202,7 @@ jobs:
       calver_tag: ${{ steps.calver.outputs.version }}
       sha_tag: sha-${{ github.sha }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -240,13 +224,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Log in to Gitea registry
+      - name: Log in to GHCR
         if: github.event_name == 'push'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
+          username: ${{ secrets.GHCR_USERNAME }}
+          password: ${{ secrets.GHCR_TOKEN }}
 
       - name: Extract metadata
         id: meta
@@ -268,8 +252,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=inline
-          cache-to: type=inline,mode=max
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Scan receiptwitness image for vulnerabilities
         uses: anchore/scan-action@v5
@@ -283,7 +267,7 @@ jobs:
           only-fixed: "true"
           output-format: sarif
 
-
+      
 
       - name: Push Docker image
         if: github.event_name == 'push'
@@ -296,7 +280,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=inline
+          cache-from: type=gha
 
   build-and-push-api:
     runs-on: ubuntu-latest
@@ -306,7 +290,7 @@ jobs:
       calver_tag: ${{ steps.calver.outputs.version }}
       sha_tag: sha-${{ github.sha }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -328,13 +312,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Log in to Gitea registry
+      - name: Log in to GHCR
         if: github.event_name == 'push'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
+          username: ${{ secrets.GHCR_USERNAME }}
+          password: ${{ secrets.GHCR_TOKEN }}
 
       - name: Extract metadata (API)
         id: meta
@@ -356,8 +340,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=inline
-          cache-to: type=inline,mode=max
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Scan api image for vulnerabilities
         uses: anchore/scan-action@v5
@@ -371,7 +355,7 @@ jobs:
           only-fixed: "true"
           output-format: sarif
 
-
+      
 
       - name: Push Docker image
         if: github.event_name == 'push'
@@ -384,7 +368,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=inline
+          cache-from: type=gha
 
   build-and-push-auth:
     runs-on: ubuntu-latest
@@ -394,7 +378,7 @@ jobs:
       calver_tag: ${{ steps.calver.outputs.version }}
       sha_tag: sha-${{ github.sha }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -416,13 +400,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Log in to Gitea registry
+      - name: Log in to GHCR
         if: github.event_name == 'push'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
+          username: ${{ secrets.GHCR_USERNAME }}
+          password: ${{ secrets.GHCR_TOKEN }}
 
       - name: Extract metadata (auth)
         id: meta
@@ -444,8 +428,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=inline
-          cache-to: type=inline,mode=max
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Scan auth image for vulnerabilities
         uses: anchore/scan-action@v5
@@ -459,7 +443,7 @@ jobs:
           only-fixed: "true"
           output-format: sarif
 
-
+      
 
       - name: Push Docker image
         if: github.event_name == 'push'
@@ -472,7 +456,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             APT_CACHE_BUST=${{ github.run_id }}
-          cache-from: type=inline
+          cache-from: type=gha
 
   deploy-dev:
     runs-on: ubuntu-latest
@@ -480,27 +464,18 @@ jobs:
     if: always() && !cancelled() && github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
     steps:
       - name: Checkout infra repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        uses: actions/checkout@v4
         with:
           repository: cartsnitch/infra
-          token: ${{ secrets.CI_GITEA_TOKEN }}
-          ref: ${{ github.ref == 'refs/heads/main' && 'main' || (github.ref == 'refs/heads/uat' && 'uat' || 'dev') }}
+          token: ${{ secrets.GITEA_TOKEN }}
+          ref: main
           path: infra
 
       - name: Install kubectl
         uses: azure/setup-kubectl@v4
 
       - name: Install kustomize
-        # imranismail/setup-kustomize@v2 calls the Gitea API to record
-        # telemetry under the "kubernetes-sigs" user, which doesn't exist
-        # on this Gitea instance. Install the binary directly instead.
-        run: |
-          set -euo pipefail
-          version="5.4.3"
-          url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${version}/kustomize_v${version}_linux_amd64.tar.gz"
-          curl -fsSL --retry 3 "$url" | tar -xz -C /tmp kustomize
-          sudo install -m 0755 /tmp/kustomize /usr/local/bin/kustomize
-          kustomize version
+        uses: imranismail/setup-kustomize@v2
 
       - name: Determine image tag for frontend
         id: frontend_tag
@@ -508,14 +483,14 @@ jobs:
           if [ "${{ github.ref }}" == "refs/heads/main" ]; then
             echo "tag=${{ needs.build-and-push.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+            echo "tag=${{ needs.build-and-push.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Update frontend image tag
         if: needs.build-and-push.result == 'success'
         run: |
           cd infra/apps/overlays/dev
-          kustomize edit set image ghcr.io/cartsnitch/app=git.farh.net/cartsnitch/cartsnitch:${{ steps.frontend_tag.outputs.tag }}
+          kustomize edit set image ghcr.io/cartsnitch/cartsnitch:${{ steps.frontend_tag.outputs.tag }}
 
       - name: Determine image tag for receiptwitness
         id: receiptwitness_tag
@@ -523,14 +498,14 @@ jobs:
           if [ "${{ github.ref }}" == "refs/heads/main" ]; then
             echo "tag=${{ needs.build-and-push-receiptwitness.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+            echo "tag=${{ needs.build-and-push-receiptwitness.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Update receiptwitness image tag
         if: needs.build-and-push-receiptwitness.result == 'success'
         run: |
           cd infra/apps/overlays/dev
-          kustomize edit set image ghcr.io/cartsnitch/receiptwitness=git.farh.net/cartsnitch/receiptwitness:${{ steps.receiptwitness_tag.outputs.tag }}
+          kustomize edit set image ghcr.io/cartsnitch/receiptwitness:${{ steps.receiptwitness_tag.outputs.tag }}
 
       - name: Determine image tag for api
         id: api_tag
@@ -538,14 +513,14 @@ jobs:
           if [ "${{ github.ref }}" == "refs/heads/main" ]; then
             echo "tag=${{ needs.build-and-push-api.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+            echo "tag=${{ needs.build-and-push-api.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Update api image tag
         if: needs.build-and-push-api.result == 'success'
         run: |
           cd infra/apps/overlays/dev
-          kustomize edit set image ghcr.io/cartsnitch/api=git.farh.net/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
+          kustomize edit set image ghcr.io/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
 
       - name: Determine image tag for auth
         id: auth_tag
@@ -553,72 +528,25 @@ jobs:
           if [ "${{ github.ref }}" == "refs/heads/main" ]; then
             echo "tag=${{ needs.build-and-push-auth.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+            echo "tag=${{ needs.build-and-push-auth.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Update auth image tag
         if: needs.build-and-push-auth.result == 'success'
         run: |
           cd infra/apps/overlays/dev
-          kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}
+          kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}
 
-      - name: Commit and push to infra (via PR)
-        env:
-          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+      - name: Commit and push to infra
         run: |
           cd infra
           git config user.name "cartsnitch-ci[bot]"
-          git config user.email "cartsnitch-ci[bot]@users.noreply.git.farh.net"
+          git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
           git add apps/overlays/dev/kustomization.yaml
           git diff --cached --quiet && echo "No image changes to deploy" && exit 0
-          BRANCH="ci/deploy-dev-${GITHUB_SHA}"
-          git checkout -b "$BRANCH"
           git commit -m "ci(dev): update cartsnitch, receiptwitness, api, and auth images"
-          git push origin "$BRANCH"
-          PR_BODY=$(printf 'Auto-opened by deploy-dev (CAR-1195).\n\nBuild SHA: %s' "${GITHUB_SHA}")
-          PR_JSON=$(curl -sS -X POST \
-            -H "Authorization: token ${CI_GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base dev --arg title "ci(dev): update overlay image tags (${GITHUB_SHA::12})" --arg body "$PR_BODY" '{head:$head,base:$base,title:$title,body:$body}')" \
-            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls")
-          PR_NUM=$(echo "$PR_JSON" | jq -r '.number // empty')
-          if [ -z "$PR_NUM" ]; then
-            echo "::error::Failed to open PR against cartsnitch/infra: $PR_JSON"
-            exit 1
-          fi
-          echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})"
-          # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort:
-          # log on non-2xx but never fail the job for this.
-          REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
-            -H "Authorization: token ${CI_GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d '{"reviewers":["cs_savannah"]}' \
-            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers")
-          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
-            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
-          fi
-          # CAR-1216: the in-job merge attempt is a best-effort fast-path only.
-          # `cartsnitch/infra` main requires a human approving review (immutable
-          # branch protection); the CI bot (`CI_GITEA_TOKEN`) can never self-
-          # approve, so this merge call structurally cannot succeed in the
-          # general case. Any non-merged outcome (approvals pending, checks
-          # pending, any other Gitea message) is the GitOps approval gate, not
-          # a CI failure — the PR is already opened and `cs_savannah` is
-          # requested as reviewer above. Surface the response as a notice and
-          # exit success. The only hard-fail (`exit 1`) in this step remains
-          # the empty-`PR_NUM` check (PR could not be created at all).
-          MERGE_RESP=$(curl -sS -X POST \
-            -H "Authorization: token ${CI_GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d '{"Do":"merge","delete_branch_after_merge":true}' \
-            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
-          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
-          if [ "$MERGED" = "true" ]; then
-            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
-          else
-            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure: $MERGE_RESP"
-            exit 0
-          fi
+          git pull --rebase origin main
+          git push origin main
 
   deploy-uat:
     runs-on: ubuntu-latest
@@ -626,27 +554,18 @@ jobs:
     if: always() && !cancelled() && github.event_name == 'push' && (github.ref == 'refs/heads/uat' || github.ref == 'refs/heads/main')
     steps:
       - name: Checkout infra repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        uses: actions/checkout@v4
         with:
           repository: cartsnitch/infra
-          token: ${{ secrets.CI_GITEA_TOKEN }}
-          ref: ${{ github.ref == 'refs/heads/main' && 'main' || (github.ref == 'refs/heads/uat' && 'uat' || 'dev') }}
+          token: ${{ secrets.GITEA_TOKEN }}
+          ref: main
           path: infra
 
       - name: Install kubectl
         uses: azure/setup-kubectl@v4
 
       - name: Install kustomize
-        # imranismail/setup-kustomize@v2 calls the Gitea API to record
-        # telemetry under the "kubernetes-sigs" user, which doesn't exist
-        # on this Gitea instance. Install the binary directly instead.
-        run: |
-          set -euo pipefail
-          version="5.4.3"
-          url="https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${version}/kustomize_v${version}_linux_amd64.tar.gz"
-          curl -fsSL --retry 3 "$url" | tar -xz -C /tmp kustomize
-          sudo install -m 0755 /tmp/kustomize /usr/local/bin/kustomize
-          kustomize version
+        uses: imranismail/setup-kustomize@v2
 
       - name: Determine image tag for frontend
         id: frontend_tag
@@ -654,14 +573,14 @@ jobs:
           if [ "${{ github.ref }}" == "refs/heads/main" ]; then
             echo "tag=${{ needs.build-and-push.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+            echo "tag=${{ needs.build-and-push.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Update frontend image tag
         if: needs.build-and-push.result == 'success'
         run: |
           cd infra/apps/overlays/uat
-          kustomize edit set image ghcr.io/cartsnitch/app=git.farh.net/cartsnitch/cartsnitch:${{ steps.frontend_tag.outputs.tag }}
+          kustomize edit set image ghcr.io/cartsnitch/cartsnitch:${{ steps.frontend_tag.outputs.tag }}
 
       - name: Determine image tag for receiptwitness
         id: receiptwitness_tag
@@ -669,14 +588,14 @@ jobs:
           if [ "${{ github.ref }}" == "refs/heads/main" ]; then
             echo "tag=${{ needs.build-and-push-receiptwitness.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+            echo "tag=${{ needs.build-and-push-receiptwitness.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Update receiptwitness image tag
         if: needs.build-and-push-receiptwitness.result == 'success'
         run: |
           cd infra/apps/overlays/uat
-          kustomize edit set image ghcr.io/cartsnitch/receiptwitness=git.farh.net/cartsnitch/receiptwitness:${{ steps.receiptwitness_tag.outputs.tag }}
+          kustomize edit set image ghcr.io/cartsnitch/receiptwitness:${{ steps.receiptwitness_tag.outputs.tag }}
 
       - name: Determine image tag for api
         id: api_tag
@@ -684,14 +603,14 @@ jobs:
           if [ "${{ github.ref }}" == "refs/heads/main" ]; then
             echo "tag=${{ needs.build-and-push-api.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+            echo "tag=${{ needs.build-and-push-api.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Update api image tag
         if: needs.build-and-push-api.result == 'success'
         run: |
           cd infra/apps/overlays/uat
-          kustomize edit set image ghcr.io/cartsnitch/api=git.farh.net/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
+          kustomize edit set image ghcr.io/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
 
       - name: Determine image tag for auth
         id: auth_tag
@@ -699,69 +618,22 @@ jobs:
           if [ "${{ github.ref }}" == "refs/heads/main" ]; then
             echo "tag=${{ needs.build-and-push-auth.outputs.calver_tag }}" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+            echo "tag=${{ needs.build-and-push-auth.outputs.sha_tag }}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Update auth image tag
         if: needs.build-and-push-auth.result == 'success'
         run: |
           cd infra/apps/overlays/uat
-          kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}
+          kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}
 
-      - name: Commit and push to infra (via PR)
-        env:
-          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+      - name: Commit and push to infra
         run: |
           cd infra
           git config user.name "cartsnitch-ci[bot]"
-          git config user.email "cartsnitch-ci[bot]@users.noreply.git.farh.net"
+          git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
           git add apps/overlays/uat/kustomization.yaml
           git diff --cached --quiet && echo "No image changes to deploy" && exit 0
-          BRANCH="ci/deploy-uat-${GITHUB_SHA}"
-          git checkout -b "$BRANCH"
           git commit -m "ci(uat): update cartsnitch, receiptwitness, api, and auth images"
-          git push origin "$BRANCH"
-          PR_BODY=$(printf 'Auto-opened by deploy-uat (CAR-1195).\n\nBuild SHA: %s' "${GITHUB_SHA}")
-          PR_JSON=$(curl -sS -X POST \
-            -H "Authorization: token ${CI_GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$(jq -n --arg head "cartsnitch:${BRANCH}" --arg base uat --arg title "ci(uat): update overlay image tags (${GITHUB_SHA::12})" --arg body "$PR_BODY" '{head:$head,base:$base,title:$title,body:$body}')" \
-            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls")
-          PR_NUM=$(echo "$PR_JSON" | jq -r '.number // empty')
-          if [ -z "$PR_NUM" ]; then
-            echo "::error::Failed to open PR against cartsnitch/infra: $PR_JSON"
-            exit 1
-          fi
-          echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})"
-          # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort:
-          # log on non-2xx but never fail the job for this.
-          REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
-            -H "Authorization: token ${CI_GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d '{"reviewers":["cs_savannah"]}' \
-            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers")
-          if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then
-            echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing"
-          fi
-          # CAR-1216: the in-job merge attempt is a best-effort fast-path only.
-          # `cartsnitch/infra` main requires a human approving review (immutable
-          # branch protection); the CI bot (`CI_GITEA_TOKEN`) can never self-
-          # approve, so this merge call structurally cannot succeed in the
-          # general case. Any non-merged outcome (approvals pending, checks
-          # pending, any other Gitea message) is the GitOps approval gate, not
-          # a CI failure — the PR is already opened and `cs_savannah` is
-          # requested as reviewer above. Surface the response as a notice and
-          # exit success. The only hard-fail (`exit 1`) in this step remains
-          # the empty-`PR_NUM` check (PR could not be created at all).
-          MERGE_RESP=$(curl -sS -X POST \
-            -H "Authorization: token ${CI_GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d '{"Do":"merge","delete_branch_after_merge":true}' \
-            "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge")
-          MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false')
-          if [ "$MERGED" = "true" ]; then
-            echo "PR #${PR_NUM} merged into cartsnitch/infra main"
-          else
-            echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure: $MERGE_RESP"
-            exit 0
-          fi
+          git pull --rebase origin main
+          git push origin main

.noop-car1374

@@ -1,2 +0,0 @@
-# CAR-1374 verification no-op
-2026-06-10T22:57:17Z CAR-1375 uat regression trigger

README.md

@@ -313,5 +313,3 @@ Secrets are managed via **Bitnami Sealed Secrets**. No plain Kubernetes secrets
 ## License
 
 MIT © 2025 CartSnitch
-
-<!-- CAR-1371 verification: trigger deploy-dev to confirm --arg base dev -->

api/.gitea/workflows/ci.yml

@@ -15,7 +15,7 @@ permissions:
   packages: write
 
 env:
-  REGISTRY: git.farh.net
+  REGISTRY: ghcr.io
   IMAGE_NAME: cartsnitch/api
 
 jobs:
@@ -130,13 +130,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Log in to Gitea registry
+      - name: Log in to GHCR
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta

api/alembic/env.py

@@ -31,6 +31,7 @@ def run_migrations_offline() -> None:
         target_metadata=target_metadata,
         literal_binds=True,
         dialect_opts={"paramstyle": "named"},
+        version_table_column_width=128,
     )
     with context.begin_transaction():
         context.run_migrations()
@@ -44,7 +45,7 @@ def run_migrations_online() -> None:
         poolclass=pool.NullPool,
     )
     with connectable.connect() as connection:
-        context.configure(connection=connection, target_metadata=target_metadata)
+        context.configure(connection=connection, target_metadata=target_metadata, version_table_column_width=128)
         with context.begin_transaction():
             context.run_migrations()
         # Create any tables defined in models but not yet created by migrations.

api/alembic/versions/001_encrypt_session_data.py

@@ -33,15 +33,6 @@ def _is_fernet_token(value: str) -> bool:
 
 
 def upgrade() -> None:
-    # Alembic hardcodes alembic_version.version_num to VARCHAR(32)
-    # (DefaultImpl.version_table_impl) and exposes no option to widen it
-    # (version_table_column_width is NOT a real kwarg — it is silently ignored).
-    # Our descriptive revision ids exceed 32 chars (e.g.
-    # 003_make_users_hashed_password_nullable = 39), so widen the column as the
-    # very first migration statement, before any early-return path below.
-    # Idempotent: a no-op when already wider (e.g. pre-created by the CAR-1298 Job).
-    op.execute("ALTER TABLE alembic_version ALTER COLUMN version_num TYPE VARCHAR(128)")
-
     conn = op.get_bind()
     inspector = sa.inspect(conn)
 

auth/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-alpine@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f AS builder
+FROM node:22-alpine AS builder
 RUN apk update && apk upgrade --no-cache
 WORKDIR /app
 COPY package.json package-lock.json* ./
@@ -7,7 +7,7 @@ COPY tsconfig.json ./
 COPY src/ src/
 RUN npm run build
 
-FROM node:22-alpine@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f
+FROM node:22-alpine
 RUN apk update && apk upgrade --no-cache
 WORKDIR /app
 ENV NODE_ENV=production

auth/src/__tests__/health.test.ts

@@ -19,18 +19,9 @@ describe('Auth health endpoint', () => {
             }
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ status: 'ok', db: 'reachable' }));
-          } catch (err) {
-            // Mirror src/index.ts: log the error and include the message in the
-            // response body so /health 503s are diagnosable from pod logs.
-            console.error(
-              '[auth /health] DB probe failed:',
-              err instanceof Error ? `${err.name}: ${err.message}` : err,
-            );
-            const detail = err instanceof Error ? err.message : 'unknown error';
+          } catch {
             res.writeHead(503, { 'Content-Type': 'application/json' });
-            res.end(
-              JSON.stringify({ status: 'error', db: 'unreachable', error: detail }),
-            );
+            res.end(JSON.stringify({ status: 'error', db: 'unreachable' }));
           }
           return;
         }
@@ -85,10 +76,7 @@ describe('Auth health endpoint', () => {
     close();
 
     equal(status, 503);
-    const parsed = JSON.parse(body);
-    equal(parsed.status, 'error');
-    equal(parsed.db, 'unreachable');
-    equal(parsed.error, 'connection refused');
+    equal(body, '{"status":"error","db":"unreachable"}');
   });
 
   it('returns 503 with db=unreachable when query times out', async () => {
@@ -107,14 +95,7 @@ describe('Auth health endpoint', () => {
     close();
 
     equal(status, 503);
-    const parsed = JSON.parse(body);
-    equal(parsed.status, 'error');
-    equal(parsed.db, 'unreachable');
-    // The query promise rejects with a synthetic 'timeout' error; the
-    // Promise.race wrapper also rejects with 'DB timeout'. The body should
-    // surface whichever error was thrown — accept either to stay robust.
-    equal(typeof parsed.error, 'string');
-    equal(parsed.error.length > 0, true);
+    equal(body, '{"status":"error","db":"unreachable"}');
   });
 
   it('returns a terminal response for unknown paths (no hang)', async () => {

auth/src/index.ts

@@ -21,19 +21,9 @@ const server = createServer(async (req, res) => {
       }
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ status: "ok", db: "reachable" }));
-    } catch (err) {
-      // Log the actual error so /health 503s are diagnosable from pod logs
-      // (CAR-1276: UAT auth was crashlooping with no log output beyond the
-      // initial "listening on port 3001" line because this catch was empty).
-      console.error(
-        "[auth /health] DB probe failed:",
-        err instanceof Error ? `${err.name}: ${err.message}` : err,
-      );
-      const detail = err instanceof Error ? err.message : "unknown error";
+    } catch {
       res.writeHead(503, { "Content-Type": "application/json" });
-      res.end(
-        JSON.stringify({ status: "error", db: "unreachable", error: detail }),
-      );
+      res.end(JSON.stringify({ status: "error", db: "unreachable" }));
     }
     return;
   }

common/alembic/versions/001_add_email_inbound_token.py

@@ -18,11 +18,6 @@ depends_on: str | Sequence[str] | None = None
 
 
 def upgrade() -> None:
-    # Same VARCHAR(32) alembic_version limitation as the api migrations; the
-    # common 002 revision id is 46 chars. Widen first so a fresh-DB upgrade can
-    # stamp it. Idempotent.
-    op.execute("ALTER TABLE alembic_version ALTER COLUMN version_num TYPE VARCHAR(128)")
-
     op.add_column("users", sa.Column("email_inbound_token", sa.String(22), nullable=True))
     op.create_unique_constraint("uq_users_email_inbound_token", "users", ["email_inbound_token"])
 

common/src/cartsnitch_common/database.py

@@ -1,36 +1,17 @@
 """Database engine and session factories for sync and async usage."""
 
 from collections.abc import AsyncGenerator, Generator
-from typing import TYPE_CHECKING
 
 from sqlalchemy import create_engine
-from sqlalchemy.ext.asyncio import AsyncEngine, AsyncSession, async_sessionmaker, create_async_engine
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 from sqlalchemy.orm import Session, sessionmaker
 
 from cartsnitch_common.config import settings
 
-if TYPE_CHECKING:
-    from sqlalchemy.engine import Engine
 
-# Module-level async engine cache — one engine per unique URL, shared across all callers.
-# This prevents pool exhaustion in high-throughput workers (e.g. email-worker hitting
-# DragonflyDB/Postgres repeatedly per message).  pool_size=10, max_overflow=20 gives
-# headroom for bursts while capping max connections at 30 per URL.
-_async_engine_cache: dict[str, "AsyncEngine"] = {}
-
-
-def get_async_engine(url: str | None = None) -> "AsyncEngine":
-    """Get or create a cached async engine for the given URL."""
-    target = url or settings.database_url
-    if target not in _async_engine_cache:
-        _async_engine_cache[target] = create_async_engine(
-            target,
-            echo=settings.debug,
-            pool_size=10,
-            max_overflow=20,
-            pool_pre_ping=True,
-        )
-    return _async_engine_cache[target]
+def get_async_engine(url: str | None = None):
+    """Create an async SQLAlchemy engine."""
+    return create_async_engine(url or settings.database_url, echo=settings.debug)
 
 
 def get_sync_engine(url: str | None = None):

lighthouserc.json

@@ -2,7 +2,7 @@
   "ci": {
     "collect": {
       "staticDistDir": "./dist",
-      "url": ["http://127.0.0.1:4173/"],
+      "url": ["http://localhost:4173/"],
       "numberOfRuns": 1,
       "settings": {
         "chromeFlags": ["--headless=new", "--no-sandbox", "--disable-gpu", "--disable-dev-shm-usage"],

package.json

@@ -45,16 +45,14 @@
     "typescript-eslint": "^8.56.1",
     "vite": "^6.4.2",
     "vite-plugin-pwa": "^0.21.2",
-    "vitest": "^4.1.8"
+    "vitest": "^3.2.4"
   },
   "overrides": {
     "@rollup/pluginutils": "5.3.0",
     "flatted": "^3.4.2",
     "serialize-javascript": "7.0.5",
-    "brace-expansion": ">=5.0.6",
+    "brace-expansion": ">=1.1.13",
     "lodash": ">=4.17.24",
-    "minimatch": "^10.2.4",
-    "@babel/plugin-transform-modules-systemjs": "^7.29.4",
-    "fast-uri": "^3.1.2"
+    "minimatch": "^10.2.4"
   }
 }

receiptwitness/src/receiptwitness/queue/email.py

@@ -16,29 +16,6 @@ logger = logging.getLogger(__name__)
 STREAM_KEY = "email:receipts"
 CONSUMER_GROUP = "email-workers"
 
-# Module-level Redis/DragonflyDB connection pool — shared across all worker calls.
-# Without pooling, each call to get_redis() opens a new TCP connection.  In a tight
-# consumer loop this causes ConnectionResetError when DragonflyDB's connection limit
-# is hit under load.  max_connections=30 (10 base + 20 overflow) mirrors the engine pool.
-_redis_pool: aioredis.ConnectionPool | None = None
-
-
-def _get_redis_pool() -> aioredis.ConnectionPool:
-    """Get or create the shared DragonflyDB connection pool."""
-    global _redis_pool
-    if _redis_pool is None:
-        _redis_pool = aioredis.ConnectionPool.from_url(
-            settings.redis_url,
-            decode_responses=True,
-            max_connections=30,
-        )
-    return _redis_pool
-
-
-async def get_redis() -> aioredis.Redis:
-    """Get async Redis/DragonflyDB client backed by a shared connection pool."""
-    return aioredis.Redis(connection_pool=_get_redis_pool())
-
 
 @dataclass
 class EmailJob:
@@ -54,6 +31,11 @@ class EmailJob:
     message_id: str  # from email provider, for dedup
 
 
+async def get_redis() -> aioredis.Redis:
+    """Get async Redis/DragonflyDB client."""
+    return cast(aioredis.Redis, aioredis.from_url(settings.redis_url, decode_responses=True))
+
+
 async def ensure_consumer_group(client: aioredis.Redis) -> None:
     """Create consumer group if it does not exist."""
     try: