fix: harden thothctl pi lifecycle

tools/thothctl/internal/pi/commands_test.go

@@ -2,6 +2,7 @@ package pi
 
 import (
 	"context"
+	"path/filepath"
 	"strings"
 	"testing"
 )
@@ -16,6 +17,20 @@ func TestDoctorRequiresExternalEndpointAuthPiStateAndHealth(t *testing.T) {
 	}
 }
 
+func TestConfigureValidatesBackendModelOptionsAndWritesNoSecrets(t *testing.T) {
+	fake := newFakeRunner()
+	path := filepath.Join(t.TempDir(), "pi-defaults.json")
+	if err := Configure(context.Background(), fake, path, Defaults{Provider: "provider", Model: "model", Thinking: "medium", LLMURL: "https://llm.example.invalid"}); err != nil {
+		t.Fatal(err)
+	}
+	if got := string(readStateBytes(t, path)); strings.Contains(got, "secret") || !strings.Contains(got, "llm.example.invalid") {
+		t.Fatalf("defaults=%q", got)
+	}
+	if err := Configure(context.Background(), fake, path, Defaults{Provider: "provider", Model: "unknown", Thinking: "medium", LLMURL: "https://llm.example.invalid"}); err == nil {
+		t.Fatal("expected unknown model rejection")
+	}
+}
+
 func TestTestUsesOnlySanitizedPiAndCoreProbes(t *testing.T) {
 	fake := newFakeRunner()
 	if err := Test(context.Background(), fake); err != nil {