ver1 - Step 5 implementation complete.

tests/test_config.py

@@ -73,6 +73,23 @@ class TestMigrationSafetySettings:
         assert settings.validate_schema_on_startup is True
 
 
+class TestSecuritySettings:
+    """Verify Step 5 security-related settings behavior."""
+
+    def test_security_defaults(self):
+        """Security controls default to disabled auth and bounded upload size."""
+        settings = _make_settings()
+        assert settings.max_upload_bytes == 15 * 1024 * 1024
+        assert settings.operator_access_enabled is False
+        assert settings.operator_username == "operator"
+        assert settings.operator_password is None
+
+    def test_operator_password_required_when_access_enabled(self):
+        """Enabling operator access requires OPERATOR_PASSWORD."""
+        with pytest.raises(ValidationError):
+            _make_settings(operator_access_enabled=True, operator_password=None)
+
+
 class TestWorkerReliabilitySettings:
     """Verify worker retry settings defaults."""