fix(auth): address Task 13 deployment review findings

tools/tht/internal/backup/create_test.go

@@ -23,6 +23,32 @@ import (
 
 var requiredTestVolumes = []string{"settings", "pi-state", "workspace-registry", "workspace-secrets", "sessions", "qdrant-data", "embedding-models"}
 
+func TestDecodeComposeImageIdentitiesAcceptsArrayAndStreamingJSON(t *testing.T) {
+	for name, input := range map[string]string{
+		"array":     `[{"ContainerName":"project-core-1","ID":"sha256:core"},{"ContainerName":"project-frontend-1","ID":"sha256:frontend"}]`,
+		"streaming": "{\"Service\":\"core\",\"ID\":\"sha256:core\"}\n{\"Service\":\"frontend\",\"ID\":\"sha256:frontend\"}\n",
+	} {
+		t.Run(name, func(t *testing.T) {
+			identities, err := decodeComposeImageIdentities(input)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(identities) != 2 || identities[0].ID != "sha256:core" || identities[1].ID != "sha256:frontend" {
+				t.Fatalf("image identities = %#v", identities)
+			}
+		})
+	}
+}
+
+func TestDecodeComposeImageIdentitiesAcceptsNoContainerForProfiledService(t *testing.T) {
+	for _, input := range []string{"", "[]"} {
+		identities, err := decodeComposeImageIdentities(input)
+		if err != nil || len(identities) != 0 {
+			t.Fatalf("decodeComposeImageIdentities(%q) = %#v, %v", input, identities, err)
+		}
+	}
+}
+
 func TestCreateWritesManifestLastWithConfigurationMetadataAndSevenVolumes(t *testing.T) {
 	fixture := newBackupFixture(t, "local")
 	output := filepath.Join(t.TempDir(), "custom.zip")