test: add comprehensive unit test suite (~85 new tests)

Add unit tests across all model and server infrastructure layers,
increasing test count from 7 to 92. Covers serde round-trips, enum
methods, defaults, config parsing, error mapping, PKCE crypto (with
RFC 7636 test vector), OAuth store, and SearXNG ranking/dedup logic.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/infrastructure/config.rs

@@ -251,3 +251,160 @@ impl LlmProvidersConfig {
         Ok(Self { providers })
     }
 }
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used)]
+
+    use super::*;
+    use pretty_assertions::assert_eq;
+    use serial_test::serial;
+
+    // -----------------------------------------------------------------------
+    // KeycloakConfig endpoint methods (no env vars needed)
+    // -----------------------------------------------------------------------
+
+    fn sample_keycloak() -> KeycloakConfig {
+        KeycloakConfig {
+            url: "https://auth.example.com".into(),
+            realm: "myrealm".into(),
+            client_id: "dashboard".into(),
+            redirect_uri: "https://app.example.com/callback".into(),
+            app_url: "https://app.example.com".into(),
+            admin_client_id: String::new(),
+            admin_client_secret: SecretString::from(String::new()),
+        }
+    }
+
+    #[test]
+    fn keycloak_auth_endpoint() {
+        let kc = sample_keycloak();
+        assert_eq!(
+            kc.auth_endpoint(),
+            "https://auth.example.com/realms/myrealm/protocol/openid-connect/auth"
+        );
+    }
+
+    #[test]
+    fn keycloak_token_endpoint() {
+        let kc = sample_keycloak();
+        assert_eq!(
+            kc.token_endpoint(),
+            "https://auth.example.com/realms/myrealm/protocol/openid-connect/token"
+        );
+    }
+
+    #[test]
+    fn keycloak_userinfo_endpoint() {
+        let kc = sample_keycloak();
+        assert_eq!(
+            kc.userinfo_endpoint(),
+            "https://auth.example.com/realms/myrealm/protocol/openid-connect/userinfo"
+        );
+    }
+
+    #[test]
+    fn keycloak_logout_endpoint() {
+        let kc = sample_keycloak();
+        assert_eq!(
+            kc.logout_endpoint(),
+            "https://auth.example.com/realms/myrealm/protocol/openid-connect/logout"
+        );
+    }
+
+    // -----------------------------------------------------------------------
+    // LlmProvidersConfig::from_env()
+    // -----------------------------------------------------------------------
+
+    #[test]
+    #[serial]
+    fn llm_providers_empty_string() {
+        std::env::set_var("LLM_PROVIDERS", "");
+        let cfg = LlmProvidersConfig::from_env().unwrap();
+        assert!(cfg.providers.is_empty());
+        std::env::remove_var("LLM_PROVIDERS");
+    }
+
+    #[test]
+    #[serial]
+    fn llm_providers_single() {
+        std::env::set_var("LLM_PROVIDERS", "ollama");
+        let cfg = LlmProvidersConfig::from_env().unwrap();
+        assert_eq!(cfg.providers, vec!["ollama"]);
+        std::env::remove_var("LLM_PROVIDERS");
+    }
+
+    #[test]
+    #[serial]
+    fn llm_providers_multiple() {
+        std::env::set_var("LLM_PROVIDERS", "ollama,openai,anthropic");
+        let cfg = LlmProvidersConfig::from_env().unwrap();
+        assert_eq!(cfg.providers, vec!["ollama", "openai", "anthropic"]);
+        std::env::remove_var("LLM_PROVIDERS");
+    }
+
+    #[test]
+    #[serial]
+    fn llm_providers_trims_whitespace() {
+        std::env::set_var("LLM_PROVIDERS", " ollama , openai ");
+        let cfg = LlmProvidersConfig::from_env().unwrap();
+        assert_eq!(cfg.providers, vec!["ollama", "openai"]);
+        std::env::remove_var("LLM_PROVIDERS");
+    }
+
+    #[test]
+    #[serial]
+    fn llm_providers_filters_empty_entries() {
+        std::env::set_var("LLM_PROVIDERS", "ollama,,openai,");
+        let cfg = LlmProvidersConfig::from_env().unwrap();
+        assert_eq!(cfg.providers, vec!["ollama", "openai"]);
+        std::env::remove_var("LLM_PROVIDERS");
+    }
+
+    // -----------------------------------------------------------------------
+    // ServiceUrls::from_env() defaults
+    // -----------------------------------------------------------------------
+
+    #[test]
+    #[serial]
+    fn service_urls_default_ollama_url() {
+        std::env::remove_var("OLLAMA_URL");
+        let svc = ServiceUrls::from_env().unwrap();
+        assert_eq!(svc.ollama_url, "http://localhost:11434");
+    }
+
+    #[test]
+    #[serial]
+    fn service_urls_default_ollama_model() {
+        std::env::remove_var("OLLAMA_MODEL");
+        let svc = ServiceUrls::from_env().unwrap();
+        assert_eq!(svc.ollama_model, "llama3.1:8b");
+    }
+
+    #[test]
+    #[serial]
+    fn service_urls_default_searxng_url() {
+        std::env::remove_var("SEARXNG_URL");
+        let svc = ServiceUrls::from_env().unwrap();
+        assert_eq!(svc.searxng_url, "http://localhost:8888");
+    }
+
+    #[test]
+    #[serial]
+    fn service_urls_custom_ollama_url() {
+        std::env::set_var("OLLAMA_URL", "http://gpu-host:11434");
+        let svc = ServiceUrls::from_env().unwrap();
+        assert_eq!(svc.ollama_url, "http://gpu-host:11434");
+        std::env::remove_var("OLLAMA_URL");
+    }
+
+    #[test]
+    #[serial]
+    fn required_env_missing_returns_config_error() {
+        std::env::remove_var("__TEST_REQUIRED_MISSING__");
+        let result = required_env("__TEST_REQUIRED_MISSING__");
+        assert!(result.is_err());
+        let err_msg = result.unwrap_err().to_string();
+        assert!(err_msg.contains("__TEST_REQUIRED_MISSING__"));
+    }
+}