feat: Add tests for config, secrets, services, and cloudflare endpoints

Fix config endpoint to return wrapped { configured, config } response
that the web UI expects. Fix services handler to return stored version
with defaults applied.

New tests:
- GetGlobalConfig: wrapped response, empty/not-configured case
- GetGlobalSecrets: leaf redaction preserves structure, raw mode
- UpdateGlobalConfig: write and verify
- CloudflareVerify: no-token case
- Services: register, list, get, update, deregister, TCP passthrough
  defaults, validation errors

15 new test cases, all passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/api/v1/handlers_config_test.go

@@ -0,0 +1,200 @@
+package v1
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/wild-cloud/wild-central/internal/storage"
+	"gopkg.in/yaml.v3"
+)
+
+func TestGetGlobalConfig_ReturnsWrappedResponse(t *testing.T) {
+	api, tmpDir := setupTestAPI(t)
+
+	// Write a config with a central domain
+	cfg := map[string]any{
+		"cloud": map[string]any{
+			"central": map[string]any{
+				"domain": "central.example.com",
+			},
+		},
+		"operator": map[string]any{
+			"email": "test@example.com",
+		},
+	}
+	data, _ := yaml.Marshal(cfg)
+	storage.WriteFile(filepath.Join(tmpDir, "config.yaml"), data, 0644)
+
+	req := httptest.NewRequest("GET", "/api/v1/config", nil)
+	w := httptest.NewRecorder()
+
+	api.GetGlobalConfig(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+
+	var resp map[string]any
+	json.Unmarshal(w.Body.Bytes(), &resp)
+
+	// Must have "configured" and "config" keys
+	if resp["configured"] != true {
+		t.Errorf("expected configured=true, got %v", resp["configured"])
+	}
+	config, ok := resp["config"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected config to be a map, got %T", resp["config"])
+	}
+
+	// Verify nested structure is preserved
+	cloud, _ := config["cloud"].(map[string]any)
+	central, _ := cloud["central"].(map[string]any)
+	if central["domain"] != "central.example.com" {
+		t.Errorf("expected domain central.example.com, got %v", central["domain"])
+	}
+}
+
+func TestGetGlobalConfig_EmptyReturnsNotConfigured(t *testing.T) {
+	api, tmpDir := setupTestAPI(t)
+
+	// Remove the default config that EnsureGlobalConfig created
+	os.Remove(filepath.Join(tmpDir, "config.yaml"))
+
+	req := httptest.NewRequest("GET", "/api/v1/config", nil)
+	w := httptest.NewRecorder()
+
+	api.GetGlobalConfig(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", w.Code)
+	}
+
+	var resp map[string]any
+	json.Unmarshal(w.Body.Bytes(), &resp)
+
+	if resp["configured"] != false {
+		t.Errorf("expected configured=false, got %v", resp["configured"])
+	}
+}
+
+func TestGetGlobalSecrets_RedactsLeafValues(t *testing.T) {
+	api, tmpDir := setupTestAPI(t)
+
+	secrets := map[string]any{
+		"cloudflare": map[string]any{
+			"apiToken": "super-secret-token",
+			"zoneId":   "zone-123",
+		},
+		"topLevelSecret": "another-secret",
+	}
+	data, _ := yaml.Marshal(secrets)
+	os.WriteFile(filepath.Join(tmpDir, "secrets.yaml"), data, 0600)
+
+	req := httptest.NewRequest("GET", "/api/v1/secrets", nil)
+	w := httptest.NewRecorder()
+
+	api.GetGlobalSecrets(w, req)
+
+	var resp map[string]any
+	json.Unmarshal(w.Body.Bytes(), &resp)
+
+	// Top-level leaf should be redacted
+	if resp["topLevelSecret"] != "********" {
+		t.Errorf("expected topLevelSecret redacted, got %v", resp["topLevelSecret"])
+	}
+
+	// Nested map structure should be preserved
+	cf, ok := resp["cloudflare"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected cloudflare to be a map, got %T", resp["cloudflare"])
+	}
+	if cf["apiToken"] != "********" {
+		t.Errorf("expected apiToken redacted, got %v", cf["apiToken"])
+	}
+	if cf["zoneId"] != "********" {
+		t.Errorf("expected zoneId redacted, got %v", cf["zoneId"])
+	}
+}
+
+func TestGetGlobalSecrets_RawShowsValues(t *testing.T) {
+	api, tmpDir := setupTestAPI(t)
+
+	secrets := map[string]any{
+		"cloudflare": map[string]any{
+			"apiToken": "my-token",
+		},
+	}
+	data, _ := yaml.Marshal(secrets)
+	os.WriteFile(filepath.Join(tmpDir, "secrets.yaml"), data, 0600)
+
+	req := httptest.NewRequest("GET", "/api/v1/secrets?raw=true", nil)
+	w := httptest.NewRecorder()
+
+	api.GetGlobalSecrets(w, req)
+
+	var resp map[string]any
+	json.Unmarshal(w.Body.Bytes(), &resp)
+
+	cf := resp["cloudflare"].(map[string]any)
+	if cf["apiToken"] != "my-token" {
+		t.Errorf("expected raw apiToken, got %v", cf["apiToken"])
+	}
+}
+
+func TestUpdateGlobalConfig(t *testing.T) {
+	api, tmpDir := setupTestAPI(t)
+
+	update := map[string]any{
+		"cloud": map[string]any{
+			"central": map[string]any{
+				"domain": "new.example.com",
+			},
+		},
+	}
+	body, _ := json.Marshal(update)
+
+	req := httptest.NewRequest("PUT", "/api/v1/config", bytes.NewReader(body))
+	w := httptest.NewRecorder()
+
+	api.UpdateGlobalConfig(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+
+	// Verify file was written
+	data, _ := os.ReadFile(filepath.Join(tmpDir, "config.yaml"))
+	var cfg map[string]any
+	yaml.Unmarshal(data, &cfg)
+
+	cloud := cfg["cloud"].(map[string]any)
+	central := cloud["central"].(map[string]any)
+	if central["domain"] != "new.example.com" {
+		t.Errorf("expected domain new.example.com, got %v", central["domain"])
+	}
+}
+
+func TestCloudflareVerify_NoToken(t *testing.T) {
+	api, _ := setupTestAPI(t)
+
+	req := httptest.NewRequest("GET", "/api/v1/cloudflare/verify", nil)
+	w := httptest.NewRecorder()
+
+	api.CloudflareVerify(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", w.Code)
+	}
+
+	var resp map[string]any
+	json.Unmarshal(w.Body.Bytes(), &resp)
+
+	if resp["tokenConfigured"] != false {
+		t.Errorf("expected tokenConfigured=false with no secrets, got %v", resp["tokenConfigured"])
+	}
+}