fix: P27 — attribute subscriber-config warnings to the user's call site

[lesnik512]

Summary

Closes the audit's last skipped item, P27. The five misconfiguration UserWarnings in _validate_subscriber_config (REJECT_ON_ERROR + retry, NACK_ON_ERROR + NoRetry, max_deliveries without retry, lease_ttl <= max_fetch_interval) used a static stacklevel=4. That's correct only for the direct @broker.subscriber(...) path; through the FastAPI OutboxRouter (which adds frames) it landed on a faststream-internal frame, so the warning pointed at library code instead of the user's decorator line.

Fix

Switched to warnings.warn(..., skip_file_prefixes=_WARN_SKIP_PREFIXES) (Python 3.12+; requires-python is >=3.13). The prefixes are the faststream_outbox and faststream package dirs, so the warning is attributed to the first caller frame outside both packages — correct for the direct and router paths, with no fragile frame-counting.

_WARN_SKIP_PREFIXES = (
    str(Path(__file__).parent.parent),       # faststream_outbox/
    str(Path(faststream.__file__).parent),   # faststream/
)

Test

test_subscriber_misconfig_warning_attributed_to_user_via_fastapi_router registers a misconfigured subscriber through the FastAPI OutboxRouter and asserts the captured warning's filename is the test file (the user), not a package frame. Mutation-verified: red under the old stacklevel=4 (it pointed at a faststream frame), green with skip_file_prefixes.

Test Plan

• New test green; verified red under the reverted stacklevel=4
• Existing pytest.warns-based factory tests unaffected (they assert message, not location)
• Full dockerized suite: 473 passed, 100% coverage; ruff + ty clean

Behavior unchanged — the warnings still fire identically; only their reported source location is corrected. Next: the P29+P30 test-broker cleanup PR.

🤖 Generated with Claude Code