test(coverage): provisioner CI service-containers unlock + internal/config ≥95%

[mastermanas805]

Summary

Closes the provisioner coverage gap by (1) wiring CI service containers so the existing env-gated integration tests actually run, and (2) testing the previously-untested internal/config package.

1. CI service-containers unlock (highest leverage)

coverage.yml ran go test ./... -short with no DB service containers. Every integration test in internal/pool and internal/backend/{postgres,redis,mongo} is gated on os.Getenv("TEST_…") reachability and was therefore skipping silently — internal/pool sat at 47.1% while the suite still reported green.

Changes:

• Added services: for postgres:16-alpine, redis:7-alpine, mongo:6 (no-auth) + a second authenticated mongo:6 on host port 27018 (for the CUSTOMER_MONGO_AUTH_URL auth-fail branches), and nats:latest -js. Each has a health-check.
• Set the exact TEST_* env vars the helpers read — names grepped from the os.Getenv call sites and liveXxx() fallbacks, not guessed: TEST_PROVISIONER_DATABASE_URL, TEST_POSTGRES_ADMIN_DSN/CUSTOMER_POSTGRES_DSN/TEST_POSTGRES_CUSTOMERS_URL, TEST_REDIS_ADDR, CUSTOMER_REDIS_URL, REDIS_URL_TEST, CUSTOMER_MONGO_URL, CUSTOMER_MONGO_AUTH_URL.
• Dropped -short: there are zero testing.Short() call sites in internal/ — the gate is purely env-var reachability. Added -p 1 so the many DB-touching packages don't open connections concurrently against the shared service containers.
• Ports use the standard host ports (5432/6379/27017/4222) because a few tests hardcode them (redis StorageBytes hits the Service ClusterIP on :6379; liveRedisAddr falls back to localhost:6379).

2. internal/config 0% → 100%

New internal/config/config_test.go covers getenv, getenvInt (valid / empty / non-numeric / negative arms), Load default and override arm for every field, the K8S_DEDICATED_BACKEND exact-"true" boolean semantics, and logStartupConfig. Uses t.Setenv for all permutations.

Coverage block (full-suite go test ./... -p 1 -coverprofile -covermode=atomic)

Package	Before	After
internal/pool	47.1%	96.4%
internal/config	0.0%	100.0%
internal/backend/postgres	99.5%	99.6%
internal/backend/redis	84.5%	95.3%
internal/backend/mongo	90.8%	96.2%
internal/backend/queue	96.8%	96.8%
full-suite total	91.6%	97.6%

All packages pass; full-suite total 97.6% clears the 95% floor with no waivers — purely test seams (env-gated integration tests now executed + new unit tests).

Note: cmd/smoke-buildinfo remains 0% (a trivial main that prints linked buildinfo, verified at the link layer by make smoke-buildinfo); its single statement is counted in the total and the suite still clears 95%.

Verification

• Verified locally against postgres:16-alpine / redis:7-alpine / mongo:6 (+ auth mongo) / nats:latest containers bound to 127.0.0.1, env exported, go test ./... -p 1 -coverprofile. go build ./... + go vet ./... clean.

🤖 Generated with Claude Code