fix: harden workspace schema contracts

backend/test/workspaces-schema.test.ts

@@ -11,6 +11,8 @@ dwh:
   engine: postgres
   database: postgres
   schema: datawarehouse
+  port: 5432
+  timeout_ms: 5000
   supported_transports:
     - postgres_direct
     - rest_api
@@ -21,6 +23,8 @@ semantic_index:
     collection: clinical_documents
     dimensions: 768
     distance: cosine
+    port: 5432
+    timeout_ms: 5000
     supported_transports:
       - pgvector_direct
       - rest_api
@@ -29,6 +33,7 @@ semantic_index:
     provider: ollama_compatible
     model: nomic-embed-text-v2-moe
     dimensions: 768
+    timeout_ms: 5000
 llm_policy:
   default: zai/glm-5.2
   allowed:
@@ -53,6 +58,16 @@ test("rejects unknown keys and invalid immutable IDs", () => {
     .toThrow(/id/i);
 });
 
+test("accepts optional connection ports and timeouts but rejects unsafe values", () => {
+  expect(parseWorkspaceYaml(validYaml).dwh.port).toBe(5432);
+  expect(() => parseWorkspaceYaml(validYaml.replace("port: 5432", "port: 0")))
+    .toThrow(/port/i);
+  expect(() => parseWorkspaceYaml(validYaml.replace("port: 5432", "port: 65536")))
+    .toThrow(/port/i);
+  expect(() => parseWorkspaceYaml(validYaml.replace("timeout_ms: 5000", "timeout_ms: 0")))
+    .toThrow(/timeout/i);
+});
+
 test("serializes canonical YAML that parses back to the same workspace", () => {
   const workspace = parseWorkspaceYaml(validYaml);
   const serialized = serializeWorkspaceYaml(workspace);