fix(auth): fail closed configuration compatibility

backend/test/config.test.ts

@@ -71,6 +71,23 @@ test("loadConfig keeps local development defaults", () => {
   expect(loadConfig({}).dataRoot).toBeUndefined();
 });
 
+test("loadConfig allows none and mock only outside production when auth.yaml is absent", () => {
+  const originalNodeEnvironment = process.env.NODE_ENV;
+  delete process.env.NODE_ENV;
+  try {
+    expect(() => loadConfig({ AUTH_MODE: "none" })).toThrow("production requires auth.yaml or AUTH_MODE=upstream");
+  } finally {
+    if (originalNodeEnvironment === undefined) delete process.env.NODE_ENV;
+    else process.env.NODE_ENV = originalNodeEnvironment;
+  }
+  expect(loadConfig({ NODE_ENV: "test", AUTH_MODE: "mock" }).authMode).toBe("mock");
+  expect(loadConfig({ NODE_ENV: "development", AUTH_MODE: "none" }).authMode).toBe("none");
+  expect(loadConfig({ NODE_ENV: "production", AUTH_MODE: "upstream" }).authMode).toBe("upstream");
+  expect(() => loadConfig({ NODE_ENV: "production" })).toThrow("production requires auth.yaml or AUTH_MODE=upstream");
+  expect(() => loadConfig({ NODE_ENV: "production", AUTH_MODE: "mock" }))
+    .toThrow("production requires auth.yaml or AUTH_MODE=upstream");
+});
+
 test("loadConfig makes an existing auth.yaml authoritative and rejects AUTH_MODE split-brain", () => {
   const { directory, file } = authFile(oidcAuthConfig());
   try {