Add config loading primitives

internal/core/config/redaction_test.go

@@ -0,0 +1,37 @@
+package config
+
+import (
+	"testing"
+
+	"gitea.maximumdirect.net/eric/notarius/internal/framework/pipeline"
+)
+
+func TestRedactedConfigRemovesAPIKeyValues(t *testing.T) {
+	cfg := Default()
+	cfg.LLMProfiles[pipeline.DefaultLLMProfile] = LLMProfile{
+		Provider:       "openai-compatible",
+		BaseURL:        "https://example.invalid/v1",
+		Model:          "test-model",
+		APIKey:         "secret",
+		APIKeyEnv:      "NOTARIUS_TEST_API_KEY",
+		TimeoutSeconds: 600,
+		MaxRetries:     3,
+		MaxConcurrency: 1,
+	}
+	cfg.LLMProfiles["other"] = LLMProfile{APIKey: "other-secret", Model: "other-model"}
+
+	redacted := cfg.Redacted()
+
+	if redacted.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != redactedSecret {
+		t.Fatalf("expected default API key redacted, got %+v", redacted.LLMProfiles[pipeline.DefaultLLMProfile])
+	}
+	if redacted.LLMProfiles["other"].APIKey != redactedSecret {
+		t.Fatalf("expected other API key redacted, got %+v", redacted.LLMProfiles["other"])
+	}
+	if redacted.LLMProfiles[pipeline.DefaultLLMProfile].Model != "test-model" {
+		t.Fatalf("expected non-secret fields preserved, got %+v", redacted.LLMProfiles[pipeline.DefaultLLMProfile])
+	}
+	if cfg.LLMProfiles[pipeline.DefaultLLMProfile].APIKey != "secret" {
+		t.Fatalf("redaction mutated original config")
+	}
+}