fix: production deployment hardening for Cloudflare Tunnel + WJ auth flow

[JackyTJie]

Summary

Deploys the backend to production behind Cloudflare Tunnel ([api.gcers.org](http://api.gcers.org/)) and fixes every issue hit while bringing up the live environment: container builds behind GFW, CSRF/cookie handling through the Worker proxy, the ORC crawler's dead domain, and several auth bugs surfaced by real user testing of the WJ (问卷) OTP flow.

The frontend (Tech-JI/CourseFront, served from Cloudflare Pages) proxies /api/* to this backend via a Worker; all changes here assume that topology.

Changes

1. Deployment / infrastructure (fix(deploy))

• Containerfile: replace [gcr.io/distroless/base-debian13:nonroot](http://gcr.io/distroless/base-debian13:nonroot) (unreachable from mainland China) with the [ghcr.io/astral-sh/uv](http://ghcr.io/astral-sh/uv) base image; add a nonroot user for parity.
• compose.yaml:
  • Add a cloudflared tunnel service, token read from .env (TUNNEL_TOKEN), forced to --protocol http2 — QUIC connections to the Cloudflare edge were being dropped by the network every ~30 min, causing intermittent 1033 errors on the public hostname.
  • Mount ./config.yaml and ./.env read-only into the container so config changes no longer require an image rebuild.
  • Rename service backend → CourseReview (matches the tunnel's public hostname service URL).
  • Fix PostgreSQL 18 volume mount: image now requires mounting at /var/lib/postgresql instead of /var/lib/postgresql/data.

2. Security / request plumbing (fix(security))

• website/settings.py:
  • New CSRF_TRUSTED_ORIGINS config (defaults empty; production values in config.yaml).
  • SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https") — requests arrive via HTTPS at Cloudflare but plain HTTP at gunicorn; without this, Django treats secure requests as insecure and SESSION_COOKIE_SECURE breaks cookie setting.
• apps/web/views.py: add @ensure_csrf_cookie to user_status. The frontend calls GET /api/user/status/ on every page load; previously the csrftoken cookie was only set on OTP endpoints, so password-login users could never make CSRF-protected POSTs (votes, reviews, logout).

3. ORC crawler (fix(spider))

• Update BASE_URL / COURSE_DETAIL_URL_PREFIX from [www.ji.sjtu.edu.cn](http://www.ji.sjtu.edu.cn/) to [gc.sjtu.edu.cn](http://gc.sjtu.edu.cn/). The old domain's TLS certificate has expired and the catalog redirects to the new host. Verified the new site's page structure (h2 headings, et_pb_text_inner blocks) still matches the parser.

4. Auth fixes (fix(auth))

• Type cast bug (the big one): AUTH__OTP_TIMEOUT=300 set via .env injects a string into the config, and the config system does not cast it. OTP_TIMEOUT is used in a float comparison in verify_callback_api — float > "300" raised TypeError, which the surrounding except swallowed and surfaced to users as "Invalid submission timestamp". Both apps/auth/views.py and apps/auth/utils.py now cast with int(...).
• Turnstile siteverify hardening (apps/auth/utils.py):
  • Dedicated 15s network timeout (previously shared the 300s OTP window — a stalled network call would hang the request).
  • Retry up to 3 times on TimeoutException / HTTPError — transient connect failures to [challenges.cloudflare.com](http://challenges.cloudflare.com/) were observed in production logs.
  • Handle non-JSON responses (rate-limit 429 HTML) with a clean 502 instead of an unhandled json() exception.
• WJ clock skew tolerance (apps/auth/views.py): the questionnaire platform's server clock was measured ~39s slow (via its HTTP Date header). Submissions made seconds after initiation were rejected as "outside validity window" because the recorded timestamp fell before the initiation time. Added a 60s tolerance on the lower bound; the upper bound (OTP window) is unchanged.
• Python 2 syntax cleanup: except ValueError, TypeError: is valid Python 3 syntax but means "catch ValueError as TypeError" — TypeError was never caught. Fixed in both auth modules. (# fmt: skip required: ruff-format incorrectly strips the tuple parens, which changes semantics.)
• Diagnostic logging for timestamp rejection (submitted/initiated/diff values) to make future failures debuggable without re-deploys.

Verification

• Backend built, migrated, and healthy in D+ Valkey 9 + gunicorn).
• 349 courses crawled and imported from the ORC catalog (4 courses skipped: codes longer than the course_code
  varchar(10) limit).
• Full login flow verified through the production chain (Cloudflare Pages → Worker proxy → Tunnel → Django): session
  cookie set, GET /api/user/status/ returnskie issued.
• Turnstile siteverify verified with the production secret key; dummy tokens correctly rejected.
• Signup OTP flow verified end-to-end with .edu.cnquestionnaires forsignup/login/reset are configured in.env`).
• ruff format + ruff check pass; pre-co

Notes for reviewers

• celery is imported by apps/spider/task in pyproject.toml`; the crawler was runwith a celery-free path in this deployment. Out of scope for this PR, but worth a follow-up.
• 4 ORC courses with combined codes (e.g. Course.course_code` max_length=10 and areskipped on import.
• config.yaml and .env are gitignored; server.