fix(vector): close local pgvector final review

harness/tests/test_config_resources.py

@@ -1,4 +1,7 @@
+import pytest
+
 from tht.config import (
+    ConfigError,
     PgvectorDirectConfig,
     PostgresDwhConfig,
     ThothRestDwhConfig,
@@ -7,6 +10,44 @@ from tht.config import (
 )
 
 
+def test_direct_vector_passwords_load_from_file_references(monkeypatch, tmp_path):
+    reader = tmp_path / "reader"
+    writer = tmp_path / "writer"
+    reader.write_text("reader-secret")
+    writer.write_text("writer-secret")
+    monkeypatch.setenv("READER_FILE", str(reader))
+    monkeypatch.setenv("WRITER_FILE", str(writer))
+    workspace = tmp_path / "workspace.yaml"
+    workspace.write_text("""
+dwh:
+  type: postgres_direct
+  connection: {database: d, schema: public, user: u, password: p}
+vectors:
+  type: pgvector_direct
+  reader: {database: d, schema: vectors, user: r, password_file: '${READER_FILE}'}
+  writer: {database: d, schema: vectors, user: w, password_file: '${WRITER_FILE}'}
+""")
+    config = load_config(workspace)
+    assert config.vectors.reader.password == "reader-secret"
+    assert config.vectors.writer.password == "writer-secret"
+
+
+def test_direct_vector_secret_file_rejects_whitespace(tmp_path):
+    secret = tmp_path / "reader"
+    secret.write_text("bad secret")
+    workspace = tmp_path / "workspace.yaml"
+    workspace.write_text(f"""
+dwh:
+  type: postgres_direct
+  connection: {{database: d, schema: public, user: u, password: p}}
+vectors:
+  type: pgvector_direct
+  reader: {{database: d, schema: vectors, user: r, password_file: {secret}}}
+""")
+    with pytest.raises(ConfigError, match="secret file"):
+        load_config(workspace)
+
+
 def test_loads_discriminated_dwh_and_vector_resources(tmp_path):
     workspace = tmp_path / "workspace.yaml"
     workspace.write_text(