Add comprehensive test and CI coverage

[xusheng6]

What changed

• add isolated Flask and MongoDB test fixtures with synthetic authenticated users
• cover onsite Markdown writeup submission, serving, attachment, and moderation workflows
• cover reviewer authentication, CSRF, approvals, rejections, administration, logging, deletion, and site archives
• expand route, model, service, validation, failure, rollback, and security coverage across the site
• add GitHub Actions jobs for every push and pull request using both mongomock and MongoDB 7
• enforce a 75% branch-coverage floor in CI
• make application configuration and MongoDB clients injectable for deterministic tests
• isolate reviewer authentication and CSRF helpers in review/auth.py

Why

The previous tests were stale in several places, accepted ambiguous outcomes, and could not reliably exercise authenticated workflows without production users or configuration. Reviewer and onsite-writeup paths also lacked sufficient integration coverage.

These changes give CI disposable users and databases, exact behavioral assertions, real-MongoDB validation, and broad coverage of important success, authorization, validation, rollback, and failure paths without browser automation.

Additional fix

The expanded tests found that a malformed None password hash raised AttributeError. Password matching now fails closed and returns False for that case.

Validation

• 194 passed
• approximately 82% statement coverage
• 78% branch coverage
• Python syntax compilation passes
• git diff --check passes