Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/company/settings_test.go

@@ -0,0 +1,55 @@
+package company
+
+import "testing"
+
+func TestAllowedSettingsKeys(t *testing.T) {
+	t.Parallel()
+	if !isAllowedSettingsKey(SettingsKeyLanguage) {
+		t.Fatal("language must be allowed")
+	}
+	if !isAllowedSettingsKey(SettingsKeyMergeProducts) {
+		t.Fatal("merge_products must be allowed")
+	}
+	if isAllowedSettingsKey("evil.injection") {
+		t.Fatal("unknown keys must be rejected")
+	}
+	if isAllowedSettingsKey("_legacy") {
+		t.Fatal("migrator markers are not client-writable prefs")
+	}
+	if isAllowedSettingsKey("_legacy_usage") {
+		t.Fatal("migrator markers are not client-writable prefs")
+	}
+}
+
+func TestValidateSettingsMap(t *testing.T) {
+	t.Parallel()
+	if err := ValidateSettingsMap(nil); err != nil {
+		t.Fatalf("nil: %v", err)
+	}
+	if err := ValidateSettingsMap(map[string]any{}); err != nil {
+		t.Fatalf("empty: %v", err)
+	}
+	if err := ValidateSettingsMap(map[string]any{
+		SettingsKeyLanguage:      "en",
+		SettingsKeyMergeProducts: true,
+	}); err != nil {
+		t.Fatalf("known keys: %v", err)
+	}
+	if err := ValidateSettingsMap(map[string]any{"prefs.theme": "dark"}); err == nil {
+		t.Fatal("expected unknown settings key")
+	} else if err.Error() != "unknown settings key" {
+		t.Fatalf("got %q", err.Error())
+	}
+	if err := ValidateSettingsMap(map[string]any{SettingsKeyLanguage: 1}); err == nil {
+		t.Fatal("expected invalid language")
+	}
+	if err := ValidateSettingsMap(map[string]any{SettingsKeyLanguage: "xx"}); err == nil {
+		t.Fatal("expected unsupported language")
+	}
+	if err := ValidateSettingsMap(map[string]any{SettingsKeyMergeProducts: "yes"}); err == nil {
+		t.Fatal("expected invalid merge_products")
+	}
+	if err := ValidateSettingsMap(map[string]any{" language": "en"}); err == nil {
+		t.Fatal("expected rejection for padded key")
+	}
+}