test: verify read-only workspace secret flow

backend/test/config.test.ts

@@ -34,9 +34,9 @@ test("loadConfig keeps local development defaults", () => {
     workspaceRegistry: {
       root: "/data/workspace-registry",
       branch: "main",
-      maxImportBytes: 10 * 1024 * 1024,
-      maxImportEntries: 32,
     },
+    workspaceSecretStoreRoot: "/data/workspace-secrets",
+    workspaceSecretRuntimeRoot: "/tmp/thothii-workspace-secrets",
     internalQdrantUrl: "http://qdrant:6333",
     internalEmbeddingUrl: "http://embedding:11434",
     internalEmbeddingModel: "qwen3-embedding:0.6b",

backend/test/workspaces-schema.test.ts

@@ -238,7 +238,7 @@ test("constructs diagnostic URLs only when the resolved URL remains on the servi
 
   expect(resolveDiagnosticUrl).toBeTypeOf("function");
   expect((resolveDiagnosticUrl as (baseUrl: string, path: string) => URL)("https://service.example/base", "/rpc/ping"))
-    .toMatchObject({ href: "https://service.example/rpc/ping" });
+    .toMatchObject({ href: "https://service.example/base/rpc/ping" });
   expect(() => (resolveDiagnosticUrl as (baseUrl: string, path: string) => URL)(
     "https://service.example/base", "//diagnostic.invalid/rpc",
   )).toThrow(/origin/i);

scripts/verify-workspace-install-docs.sh

@@ -1766,8 +1766,13 @@ if not any(mount.get("source") == "workspace-secrets" and mount.get("target") ==
 checked = [
     root / "docs/install/local-workspace-registry.md",
     root / "docs/install/server-workspace-registry.md",
+    root / "docs/install/local.md",
+    root / "docs/install/server.md",
+    root / "docs/install/psd-workspace-setup.md",
     root / "docs/guida-utente.md",
     root / "deploy/workspace-registry.env.example",
+    root / "deploy/env/local.env.example",
+    root / "deploy/env/server.env.example",
     root / "deploy/psd/operator.env.example",
     root / "docs/install/examples/thothii-installation.local.yaml",
     root / "docs/install/examples/thothii-installation.server.yaml",