fix: auto-generate JWT secret fallback, remove psycopg2-binary, harden startup

- config.py: replace ValueError crash with auto-generated ephemeral JWT key + warning
  (root cause of Azure infinite restart loop)
- requirements.txt: remove unused psycopg2-binary (saves ~30s build time)
- startup.sh: add timeout 180 to pip install fallback
- deploy-azure.yml: pass JWT_SECRET_KEY from GitHub Secrets to Azure app settings

Author: Scarage1

.github/workflows/deploy-azure.yml

@@ -66,7 +66,8 @@ jobs:
             --name ${{ env.AZURE_WEBAPP_NAME }} \
             --settings \
               SCM_DO_BUILD_DURING_DEPLOYMENT=true \
-              WEBSITE_STARTUP_TIME_LIMIT=600
+              WEBSITE_STARTUP_TIME_LIMIT=600 \
+              JWT_SECRET_KEY="${{ secrets.JWT_SECRET_KEY }}"
 
       - name: Create deployment package
         run: |

requirements.txt

@@ -24,7 +24,6 @@ aiosqlite>=0.19.0
 sqlalchemy[asyncio]>=2.0.25
 alembic>=1.13.1
 asyncpg>=0.29.0
-psycopg2-binary>=2.9.9
 
 # Cache — Redis (prod, optional for dev)
 redis>=5.0.0

src/config.py

@@ -10,14 +10,18 @@
 """
 from __future__ import annotations
 
+import logging
 import os
+import secrets
 from functools import lru_cache
 from pathlib import Path
 from typing import List, Optional
 
 from pydantic import field_validator
 from pydantic_settings import BaseSettings
 
+logger = logging.getLogger(__name__)
+
 
 class Settings(BaseSettings):
     """Application settings — populated from environment variables."""
@@ -90,10 +94,14 @@ def _require_jwt_secret(cls, v: str) -> str:
         # Allow empty only when TESTING
         if os.getenv("TESTING", "").lower() in ("true", "1"):
             return "test-only-insecure-key"
-        raise ValueError(
-            "JWT_SECRET_KEY environment variable is required in production. "
-            "Set it to a strong random string (e.g. `openssl rand -hex 32`)."
+        # Auto-generate a secret so the app can boot, but warn loudly
+        generated = secrets.token_hex(32)
+        logger.warning(
+            "⚠️  JWT_SECRET_KEY not set — auto-generated an ephemeral key. "
+            "Sessions will NOT survive restarts. Set JWT_SECRET_KEY in your "
+            "environment for production use."
         )
+        return generated
 
     @field_validator("cors_allowed_origins", mode="before")
     @classmethod

startup.sh

@@ -8,8 +8,8 @@ cd /home/site/wwwroot
 
 # Install dependencies if Oryx build didn't run (fallback)
 if ! python -c "import gunicorn" 2>/dev/null; then
-  echo "Installing Python dependencies..."
-  pip install --no-cache-dir -r requirements.txt 2>&1 | tail -5
+  echo "Installing Python dependencies (timeout 180s)..."
+  timeout 180 pip install --no-cache-dir -r requirements.txt 2>&1 | tail -5 || echo "⚠️  pip install timed out or failed (non-fatal)"
 fi
 
 # Run database migrations (safe to run repeatedly — no-ops if up to date)