feat(contract): add opt-in MAX configuration and lifecycle

Refs #81

tests/test_contracts_max.py

@@ -0,0 +1,47 @@
+"""MAX stays off without credentials; enabled deployments fail closed on incomplete settings."""
+
+import pytest
+from pydantic import ValidationError
+
+from app.config import Settings
+
+
+def configured(**overrides):
+    fields = {
+        "max_enabled": True,
+        "max_bot_token": "test-only-token",
+        "max_bot_username": "test_bot",
+        "max_webhook_secret": "test-only-secret-" * 3,
+        "max_webhook_url": "https://api.example.org/api/v1/webhooks/max",
+        "max_site_url": "https://patient.example.org/#/today",
+    }
+    return Settings(_env_file=None, **(fields | overrides))
+
+
+def test_max_disabled_by_default():
+    assert not Settings(_env_file=None).max_enabled
+
+
+def test_max_secrets_are_redacted():
+    settings = configured()
+    assert "test-only-token" not in repr(settings)
+    assert "test-only-secret" not in repr(settings)
+
+
+@pytest.mark.parametrize(
+    "overrides",
+    [
+        {"max_bot_token": ""},
+        {"max_bot_username": "@test_bot"},
+        {"max_webhook_secret": "short"},
+        {"max_site_url": "http://patient.example.org"},
+        {"max_webhook_url": "http://api.example.org"},
+        {"max_webhook_url": "https://api.example.org:8443/hook"},
+        {"max_webhook_url": "https://user:password@api.example.org/hook"},
+        {"max_webhook_url": "https://api.example.org/hook#fragment"},
+        {"max_site_url": "https://patient.example.org?token=credential"},
+    ],
+)
+def test_max_rejects_incomplete_or_unsafe_settings(overrides):
+    with pytest.raises(ValidationError):
+        configured(**overrides)