feat: render private semantic service endpoints

backend/test/workspaces-contracts.test.ts

@@ -97,6 +97,20 @@ test("renders English UI headings and workspace-language Italian prose", () => {
   expect(docs.envExample).toContain("THT_WS_PSD_CLINICAL_VECTOR_TRANSPORT=");
 });
 
+test("schema v3 installation contracts expose only DWH bindings and no semantic variables", () => {
+  const contract = buildInstallationContract(workspaceV3);
+  const names = contract.variables.map((variable) => variable.name);
+  const docs = renderWorkspaceDocs(workspaceV3);
+
+  expect(contract.variables.every((variable) => variable.role === "DWH")).toBe(true);
+  expect(names).toContain("THT_WS_PSD_CLINICAL_DWH_TRANSPORT");
+  expect(names.some((name) => /_VECTOR_|_EMBEDDING_/.test(name))).toBe(false);
+  expect(docs.envExample).not.toContain("_VECTOR_");
+  expect(docs.envExample).not.toContain("_EMBEDDING_");
+  expect(docs.markdown).not.toContain("Vector store");
+  expect(docs.markdown).not.toContain("Embedding service");
+});
+
 test("renders the vector store identity and creates writer credentials only when declared", () => {
   const writerWorkspace = parseWorkspaceYaml(`workspace:
   schema_version: 2