feat: replace custom middleware with Django's LoginRequiredMiddleware

[TudorGR]

Replace custom middleware with Django's LoginRequiredMiddleware

Description

Replace Weblate's custom RequireLoginMiddleware with Django 5.1's built-in LoginRequiredMiddleware to simplify authentication handling and reduce maintenance burden.

Changes

• Remove weblate.accounts.middleware.RequireLoginMiddleware class (~75 lines)
• Use django.contrib.auth.middleware.LoginRequiredMiddleware when REQUIRE_LOGIN=True
• Add @login_not_required decorator to git_export view for HTTP Basic Auth compatibility
• Remove obsolete LOGIN_REQUIRED_URLS and LOGIN_REQUIRED_URLS_EXCEPTIONS settings
• Update tests in weblate.accounts.tests.test_middleware to verify Django middleware behavior
• Deprecate Docker environment variables: WEBLATE_LOGIN_REQUIRED_URLS_EXCEPTIONS, WEBLATE_ADD_LOGIN_REQUIRED_URLS_EXCEPTIONS, and WEBLATE_REMOVE_LOGIN_REQUIRED_URLS_EXCEPTIONS
• Update documentation in docs/changes.rst with compatibility notes

Implementation Details

All public views throughout the codebase already use the @login_not_required decorator (introduced in Django 5.1), making this migration straightforward. The middleware is conditionally added only when REQUIRE_LOGIN=True, maintaining backward compatibility.

The Git exporter view required special attention as it implements HTTP Basic Authentication independently. It now uses @login_not_required to bypass the login requirement while maintaining its own authentication logic.

Testing

• Updated test suite to verify Django's LoginRequiredMiddleware behavior
• Tests confirm public endpoints remain accessible (/healthz/, /api/, /widgets/, etc.)
• Tests verify protected views redirect anonymous users to login when REQUIRE_LOGIN=True
• Tests verify authenticated users can access all views
• No syntax errors in modified files

Documentation

• Added comprehensive compatibility notes to changelog
• Documented deprecation of URL-based exception configuration
• Added explanatory comments in settings files

Closes #16934

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
5163	1	5162	663

View the top 1 failed test(s) by shortest run time

::weblate.accounts.tests.test_middleware

Stack Traces | 0s run time

.../accounts/tests/test_middleware.py:20: in <module>
    class MiddlewareTest(TestCase):
.../accounts/tests/test_middleware.py:29: in MiddlewareTest
    @method_decorator(login_not_required)
     ^^^^^^^^^^^^^^^^
E   NameError: name 'method_decorator' is not defined

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[nijel]

Looks good once the ruff and mypy errors are fixed.

[nijel]

Suggested change

	def public_view(self, request) -> str:
	"""A public view marked with @login_not_required decorator."""
	def public_view(self, request: HttpRequest) -> str:
	"""View not requiring login."""

[nijel]

Suggested change

	def protected_view(self, request) -> str:
	"""A protected view without the @login_not_required decorator."""
	def protected_view(self, request: HttpRequest) -> str:
	"""View requiring login."""

[nijel]

Did you actually test running with the middleware?

• It fails with the system check auth.E013, probably should be ignored (we're using custom auth middleware).
• Login ends up in a redirect loop.
• Admin login is not working either.

[nijel]

The remaining bit is /admin/login/ which should also work without requiring login (it always allows local login even if it is disabled for user authentication).

[nijel]

Merged, thanks for your contribution! I had to do some documentation adjustments before.