test: establish monitoring configuration contract

backend/app/services/settings_validation.py

@@ -0,0 +1,21 @@
+"""Runtime validation for security-sensitive application settings."""
+
+from app.config import LEGACY_DEFAULT_SECRET, Settings
+
+
+def validate_runtime_settings(settings: Settings) -> None:
+    """Reject unsafe settings before scheduling monitoring work."""
+    if settings.environment == "production":
+        if settings.secret_key == LEGACY_DEFAULT_SECRET:
+            raise ValueError("SECRET_KEY must be provided by the runtime environment")
+        if not settings.casdoor_endpoint.startswith("https://"):
+            raise ValueError("CASDOOR endpoint must use TLS in production")
+
+    if settings.wecom_notification_enabled:
+        credentials = (
+            settings.WECOM_CORP_ID,
+            settings.WECOM_AGENT_ID,
+            settings.WECOM_APP_SECRET,
+        )
+        if not all(credentials):
+            raise ValueError("WECOM delivery requires corp ID, agent ID, and app secret")