fix: fail closed on production settings

backend/tests/test_settings_validation.py

@@ -15,11 +15,41 @@ def test_production_rejects_legacy_jwt_secret():
         validate_runtime_settings(settings)
 
 
+@pytest.mark.parametrize("secret_key", ["", "   ", "\t\n"])
+def test_production_rejects_blank_jwt_secret(secret_key):
+    settings = Settings(environment="production", secret_key=secret_key)
+
+    with pytest.raises(ValueError, match="SECRET_KEY"):
+        validate_runtime_settings(settings)
+
+
+@pytest.mark.parametrize("environment", ["prod", "Production", "staging"])
+def test_environment_must_be_an_explicit_supported_value(environment):
+    with pytest.raises(ValidationError, match="environment"):
+        Settings(environment=environment)
+
+
 def test_probe_packet_count_must_be_positive():
     with pytest.raises(ValidationError):
         Settings(probe_packets_per_round=0)
 
 
+@pytest.mark.parametrize(
+    ("field", "invalid_value"),
+    [
+        ("offline_consecutive_rounds", 0),
+        ("degraded_window_rounds", 1),
+        ("degraded_loss_percent", 0.0),
+        ("recovery_consecutive_clean_rounds", 0),
+        ("wecom_notification_max_attempts", 0),
+        ("wecom_retry_base_seconds", 0),
+    ],
+)
+def test_monitoring_and_retry_settings_reject_values_below_their_bounds(field, invalid_value):
+    with pytest.raises(ValidationError):
+        Settings(**{field: invalid_value})
+
+
 def test_production_rejects_tls_disabled_casdoor():
     settings = Settings(
         environment="production",