feat: add TTLCache for get_cache_version and TEMPLATE_AUTO_RELOAD config with Makefile worker count variables

tests/api/docs/index.py

@@ -98,6 +98,8 @@ def _seed_news_audit_log():
     title = _unique("aunews")
     get_table("news").insert(
         {
+            "deleted_at": None,
+            "deleted_by": None,
             "uid": uid,
             "slug": make_combined_slug(title, uid),
             "title": title,
@@ -297,6 +299,7 @@ def test_docs_operator_pages_require_admin(seeded_db):
         assert "/docs/services.html" in admin_index.text
     finally:
         users.update({"uid": bob["uid"], "role": "Member"}, ["uid"])
+        clear_user_cache(bob["uid"])
 
 
 def test_docs_endpoint_config_is_valid_json(app_server):
@@ -396,9 +399,20 @@ def test_media_moderation_doc_is_admin_only(seeded_db):
     # hidden from guests and members
     assert requests.get(f"{BASE_URL}/docs/media-moderation.html").status_code == 404
     bob = get_table("users").find_one(username="bob_test")
-    member = requests.get(
-        f"{BASE_URL}/docs/media-moderation.html", headers={"X-API-KEY": bob["api_key"]}
-    )
+    clear_user_cache(bob["uid"])
+    # A prior test may have promoted bob and warmed the server's auth cache; the
+    # cache-version bump propagates cross-process with up to a one second delay,
+    # so poll until the server resolves bob back to a member (404).
+    deadline = time.time() + 5
+    member = None
+    while time.time() < deadline:
+        member = requests.get(
+            f"{BASE_URL}/docs/media-moderation.html",
+            headers={"X-API-KEY": bob["api_key"]},
+        )
+        if member.status_code == 404:
+            break
+        time.sleep(0.2)
     assert member.status_code == 404
     # visible to admins, and this is where soft-delete is explained
     admin = get_table("users").find_one(username="alice_test")