feat: expose API runtime identity in health

tests/test_dev_stack.py

@@ -38,7 +38,18 @@ def test_dev_api_health_endpoint_is_healthy():
     assert response.status_code == 200
     payload = response.json()
     assert payload['status'] == 'healthy'
+
+    runtime = payload['runtime']
+    assert runtime['api_runtime_role'] == 'dev'
+    assert runtime['start_mode'] == 'dev'
+    assert runtime['app_environment'] == 'development'
+    assert runtime['environment'] == 'development'
+    assert runtime['backend_dev_mode'] is True
+    assert runtime['compose_project'] == 'api-dev'
+    assert runtime['supabase_url_host'] == '192.168.0.94'
+
     assert payload['services']['supabase']['status'] == 'healthy'
+    assert payload['services']['supabase']['url_host'] == '192.168.0.94'
     assert payload['services']['redis']['status'] == 'healthy'
     assert payload['services']['redis']['environment'] == 'dev'
     assert payload['services']['redis']['database'] == 0
@@ -53,3 +64,19 @@ def test_supabase_dev_seed_core_counts():
 def test_supabase_dev_seed_timetable_counts():
     assert _rest_count('classes') == 17
     assert _rest_count('taught_lessons') == 1462
+
+
+def test_runtime_identity_does_not_expose_secret_values():
+    health_url = os.getenv('API_HEALTH_URL', 'http://192.168.0.64:18000/health')
+    response = requests.get(health_url, timeout=15)
+    assert response.status_code == 200
+    payload_text = response.text
+    for secret_name in ('SERVICE_ROLE_KEY', 'ANON_KEY', 'SUPABASE_JWT_SECRET', 'REDIS_PASSWORD'):
+        secret_value = os.getenv(secret_name)
+        if secret_value:
+            assert secret_value not in payload_text
+
+    runtime = response.json()['runtime']
+    assert 'supabase_url' not in runtime
+    assert 'service_role_key' not in runtime
+    assert 'anon_key' not in runtime