refactor: code quality improvements across the backend

- Remove insecure SSL verification bypass in attendance.py
- Add gunicorn as production WSGI server (Dockerfile + entrypoint)
- Fix silent data loss in reconciliation (log + surface unmatched members)
- Add required column validation in payment sheet parsing
- Add input validation on /qr route (account format, amount bounds, SPD injection)
- Centralize configuration into scripts/config.py
- Extract credentials path to env-configurable constant
- Hide unmatched transactions from reconcile-juniors page
- Fix test mocks to bypass cache layer (all 8 tests now pass reliably)
- Add pytest + pytest-cov dev dependencies
- Fix typo "Inffering" in infer_payments.py
- Update CLAUDE.md to reflect current project state

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/attendance.py

@@ -5,8 +5,8 @@ import io
 import urllib.request
 from datetime import datetime
 
-SHEET_ID = "1E2e_gT_K5AwSRCDLDTa2UetZTkHmBOcz0kFbBUNUNBA"
-JUNIOR_SHEET_GID = "1213318614"
+from config import ATTENDANCE_SHEET_ID as SHEET_ID, JUNIOR_SHEET_GID
+
 EXPORT_URL = f"https://docs.google.com/spreadsheets/d/{SHEET_ID}/export?format=csv&gid=0"
 JUNIOR_EXPORT_URL = f"https://docs.google.com/spreadsheets/d/{SHEET_ID}/export?format=csv&gid={JUNIOR_SHEET_GID}"
 
@@ -34,13 +34,8 @@ FIRST_DATE_COL = 3
 
 def fetch_csv(url: str = EXPORT_URL) -> list[list[str]]:
     """Fetch the attendance Google Sheet as parsed CSV rows."""
-    import ssl
-    ctx = ssl.create_default_context()
-    ctx.check_hostname = False
-    ctx.verify_mode = ssl.CERT_NONE
-    
     req = urllib.request.Request(url)
-    with urllib.request.urlopen(req, context=ctx) as resp:
+    with urllib.request.urlopen(req) as resp:
         text = resp.read().decode("utf-8")
     reader = csv.reader(io.StringIO(text))
     return list(reader)