test: add characterization tests for core modules

33 tests covering env/io helpers, config parsers, pipeline meta I/O,
worker inbox logic, and FastAPI smoke routes. No gmic/rembg subprocesses.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_main.py

@@ -0,0 +1,42 @@
+"""Tests for FastAPI routes and validation."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+from app import config, pipeline
+from app.main import _safe_job_file, _validate_job_id, app
+from fastapi import HTTPException
+from fastapi.testclient import TestClient
+
+
+@pytest.fixture
+def client(data_dir: Path) -> TestClient:
+    return TestClient(app)
+
+
+def test_validate_job_id_sanitizes_input() -> None:
+    assert _validate_job_id("foo@bar") == "foo_bar"
+    assert _validate_job_id("photo01") == "photo01"
+
+
+def test_safe_job_file_rejects_wrong_prefix(data_dir: Path) -> None:
+    stem = "photo01"
+    paths = pipeline.job_paths(stem)
+    paths.variants.mkdir(parents=True, exist_ok=True)
+    target = paths.variants / f"{stem}_v1.png"
+    target.write_bytes(b"x")
+    with pytest.raises(HTTPException):
+        _safe_job_file(stem, "other_v1.png")
+
+
+def test_index_empty(client: TestClient) -> None:
+    response = client.get("/")
+    assert response.status_code == 200
+    assert config.SITE_TITLE in response.text
+
+
+def test_job_not_found(client: TestClient) -> None:
+    response = client.get("/jobs/does-not-exist")
+    assert response.status_code == 404