Panel plane: service-token auth and snapshot route (#152)

tests/test_api_health.py

@@ -69,7 +69,12 @@ class _AppRunner:
     """
 
     def __init__(self, db_path: str) -> None:
-        self.app = create_app(ApiConfig(db_path=db_path))
+        # The token value is irrelevant to these tests (the health
+        # route is unauthenticated); it just satisfies the required
+        # field — the panel token's own tests live in test_api_panel.py.
+        self.app = create_app(
+            ApiConfig(db_path=db_path, panel_token="health-runner-token")
+        )
 
     async def __aenter__(self) -> httpx.AsyncClient:
         self._lifespan = self.app.router.lifespan_context(self.app)
@@ -97,9 +102,15 @@ async def app_client(temp_db_path: str) -> httpx.AsyncClient:
 
 
 def test_from_env_returns_set_value() -> None:
-    """A set, non-empty NESTQUEST_DB_PATH is returned verbatim."""
-    cfg = ApiConfig.from_env({"NESTQUEST_DB_PATH": "/data/nq.db"})
+    """Set, non-empty env values are returned verbatim."""
+    cfg = ApiConfig.from_env(
+        {
+            "NESTQUEST_DB_PATH": "/data/nq.db",
+            "NESTQUEST_PANEL_TOKEN": "panel-token",
+        }
+    )
     assert cfg.db_path == "/data/nq.db"
+    assert cfg.panel_token == "panel-token"
 
 
 def test_from_env_raises_on_empty_value() -> None:
@@ -283,10 +294,11 @@ _NO_HA_SCRIPT = textwrap.dedent(
 
     # Build the app (the lifespan is NOT run here, so the path is never
     # opened — it just needs to be a non-empty string to satisfy the
-    # fail-fast config check).  Use a temp path so nothing is created.
+    # fail-fast config check).  Use a temp path so nothing is created;
+    # the panel token value is irrelevant to this import-only check.
     app = create_app(ApiConfig(db_path=str(
         Path(tempfile.gettempdir()) / "nq-noha-buildonly.db"
-    )))
+    ), panel_token="noha-import-token"))
     assert app is not None
 
     print("API NO-HA IMPORT OK")