fix(workspace): isolate maintenance authentication surface

backend/test/config.test.ts

@@ -97,6 +97,17 @@ test("loadConfig allows none and mock only outside production when auth.yaml is
     .toThrow("production requires auth.yaml or AUTH_MODE=upstream");
 });
 
+test("workspace maintenance loads production configuration without an authentication surface", () => {
+  expect(loadConfig(
+    { NODE_ENV: "production", THOTH_PUBLIC_EXPOSURE: "true" },
+    { surface: "workspace-maintenance" },
+  )).toMatchObject({
+    authMode: "none",
+    authentication: undefined,
+    publicExposure: false,
+  });
+});
+
 test("local Compose profiles explicitly select the development auth environment", () => {
   for (const profile of ["../../deploy/compose.local.yaml", "../../docker-compose.dev.yml"]) {
     expect(readFileSync(new URL(profile, import.meta.url), "utf8")).toMatch(/NODE_ENV:\s*development/);