Add unit test suite for main.py (0% -> 95% coverage)

[devin-ai-integration]

Summary

The repo had no tests — the single main.py module (the entire codebase) sat at 0% coverage. This PR adds a pytest suite that brings main.py to 95% statement coverage (96 tests), targeting the previously-untested application logic.

Coverage went 0% -> 95%; the only remaining uncovered lines are a handful of defensive except branches in the WS relay and the __main__/uvicorn bootstrap.

What's added

• pytest.ini — asyncio_mode = auto, testpaths = tests.
• requirements-dev.txt — pins pytest, pytest-asyncio, pytest-cov on top of requirements.txt.
• tests/conftest.py — an autouse reset_state fixture that clears the module-level globals (LINKS, SESSIONS, AUTH, stats, connections, error_logs, hourly_traffic) around every test so the in-memory state is deterministic, plus client / auth_client TestClient fixtures.

Test breakdown

• test_helpers.py — pure helpers: hash_password, generate_uuid (seeded + random), generate_vless_link, uptime, parse_size_to_bytes, get_host, format_link_uuid.
• test_sessions.py — create_session / is_valid_session (incl. expiry purge) / destroy_session / require_auth.
• test_links_logic.py — ensure_default_link (idempotency), check_quota (unknown/inactive/unlimited/at-limit/over-limit), add_usage.
• test_vless_header.py — parse_vless_header for IPv4 / domain / IPv6, addon skipping, payload extraction, and the too-small / unknown-address-type ValueError paths.
• test_api.py — endpoint behavior via TestClient: /, /health, login/logout/me, change-password (auth + validation), /stats, full /api/links CRUD (create/list/toggle/delete, 404s, label truncation), page routes (login/dashboard redirects, /test-ws), and the proxy success + 502 error branches (with http_client monkeypatched — no real network).
• test_relay.py — ws_to_tcp / tcp_to_ws with fake WebSocket/reader/writer: byte relaying, usage accounting, the \x00\x00 first-frame prefix, and quota-exceeded 1008 closes.
• test_websocket_tunnel.py — end-to-end /ws/{uuid} against a threaded local TCP echo server (accept -> parse header -> open_connection -> relay), plus the disabled-link immediate-close path.

Run

pip install -r requirements-dev.txt
pytest --cov=main --cov-report=term-missing
# 96 passed ... main.py  371  17  95%

No production code in main.py was modified.

Link to Devin session: https://app.devin.ai/sessions/47ddcdd850fa4f3d9b4e067b37e4e907
Requested by: @hmilan1366

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring