feat(slice-2): config — session secret, cookie_secure, mailer_kind (INV-8)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/tests/test_config.py

@@ -11,3 +11,33 @@ def test_database_url_defaults_to_local_compose(monkeypatch):
 def test_database_url_honors_env(monkeypatch):
     monkeypatch.setenv("ECOMM_DATABASE_URL", "postgresql://x:y@db:5432/z")
     assert config.database_url() == "postgresql://x:y@db:5432/z"
+
+
+def test_session_secret_defaults_for_dev(monkeypatch):
+    monkeypatch.delenv("ECOMM_SESSION_SECRET", raising=False)
+    # A non-empty dev default so localhost works with no setup; deployed overrides it.
+    assert config.session_secret()
+
+
+def test_session_secret_honors_env(monkeypatch):
+    monkeypatch.setenv("ECOMM_SESSION_SECRET", "s3cret")
+    assert config.session_secret() == "s3cret"
+
+
+def test_cookie_secure_defaults_false(monkeypatch):
+    monkeypatch.delenv("ECOMM_COOKIE_SECURE", raising=False)
+    assert config.cookie_secure() is False
+
+
+def test_cookie_secure_truthy_env(monkeypatch):
+    monkeypatch.setenv("ECOMM_COOKIE_SECURE", "1")
+    assert config.cookie_secure() is True
+    monkeypatch.setenv("ECOMM_COOKIE_SECURE", "true")
+    assert config.cookie_secure() is True
+    monkeypatch.setenv("ECOMM_COOKIE_SECURE", "0")
+    assert config.cookie_secure() is False
+
+
+def test_mailer_kind_defaults_to_log(monkeypatch):
+    monkeypatch.delenv("ECOMM_MAILER", raising=False)
+    assert config.mailer_kind() == "log"