feat(agent): add test frontend and Docker stack

pv-agent/tests/test_api.py

@@ -69,6 +69,32 @@ def configure_state(*, api_key: str = "", admin_key: str = "") -> None:
     app.state.rag.retriever = FakeRetriever()
 
 
+def test_frontend_is_served_with_security_headers():
+    with TestClient(app) as client:
+        configure_state(api_key="service-secret")
+        response = client.get("/")
+        assert response.status_code == 200
+        assert "PV Wissen" in response.text
+        assert "service-secret" not in response.text
+        assert response.headers["cache-control"] == "no-store"
+        assert response.headers["x-frame-options"] == "DENY"
+        assert response.headers["x-content-type-options"] == "nosniff"
+        assert "script-src 'self'" in response.headers["content-security-policy"]
+
+
+def test_frontend_assets_use_v1_api_and_unknown_assets_are_hidden():
+    with TestClient(app) as client:
+        configure_state()
+        script = client.get("/assets/app.js")
+        styles = client.get("/assets/styles.css")
+        missing = client.get("/assets/index.html")
+        assert script.status_code == 200
+        assert styles.status_code == 200
+        assert 'fetch("/v1/ask"' in script.text
+        assert "innerHTML" not in script.text
+        assert missing.status_code == 404
+
+
 def test_nonlocal_bind_without_api_key_is_rejected(capsys):
     class Args:
         host = "0.0.0.0"