fix: address PR #814 review + SonarCloud gate

SonarCloud:
- Resolve 6 S5332 hotspots (http→https in test fixture URLs).
- S6418: hoist the unauthenticated AsyncOpenAI placeholder to a named constant
  + NOSONAR (genuine non-secret; gateway ignores it when unauthenticated).
- Fix two reliability bugs: None-index guard in the gateway token-cache test
  (S2259) and float `> 0.0` instead of `!= 0.0` in the sentinel test (S1244).
- status.py idle path sleeps 0.1s instead of sleep(0) (S7491); NOSONAR on the
  protocol-required async no-await aclose() stubs (S7503).

Claude review:
- Remove three leftover debug print() calls in app.py (logger.info already
  covers them).
- payload_backfill: drop parsed_at from the backfilled-keys docstring (it is
  per-document state, not a deployment scalar); add a clean 404 precondition
  for BasicAuth deployments without an OAuth token verifier.
- status.py: task_status typed TaskStatus | None (drop type: ignore).
- nats.py: TODO to thread etags for file/deck/news; note etag default → None.
- factory: warn on unknown INGEST_BUS_URL scheme; raise ValueError instead of
  assert for the external-mode preconditions.
- docs/configuration.md: document the decomposition hook-point env vars + that
  nats-py ships core (lazy-imported) and external+bus uses two NATS connections.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/providers/test_gateway_provider.py

@@ -29,7 +29,7 @@ def _patch_settings(monkeypatch, settings):
 def test_gateway_selected_unauthenticated(monkeypatch):
     settings = Settings(
         embedding_provider="gateway",
-        embedding_gateway_url="http://gateway:8083",
+        embedding_gateway_url="https://gateway:8083",
         embedding_gateway_model="mistral-embed",
     )
     _patch_settings(monkeypatch, settings)
@@ -44,7 +44,7 @@ def test_gateway_selected_unauthenticated(monkeypatch):
 def test_gateway_selected_with_m2m_oidc(monkeypatch):
     settings = Settings(
         embedding_provider="gateway",
-        embedding_gateway_url="http://gateway:8083",
+        embedding_gateway_url="https://gateway:8083",
         embedding_gateway_token_url="https://idp.example/oauth2/token",
         embedding_gateway_client_id="mcp-server",
         embedding_gateway_client_secret="shh",
@@ -60,7 +60,7 @@ def test_partial_m2m_creds_rejected():
     with pytest.raises(ValueError, match="must be set together"):
         Settings(
             embedding_provider="gateway",
-            embedding_gateway_url="http://gateway:8083",
+            embedding_gateway_url="https://gateway:8083",
             embedding_gateway_client_id="mcp-server",  # missing token_url/secret
         )
 
@@ -111,6 +111,7 @@ async def test_token_provider_caches_and_refreshes(monkeypatch):
     assert calls["n"] == 1
 
     # Expire the cache → next call refreshes.
+    assert tp._cache is not None
     tp._cache = (tp._cache[0], time.time() - 1)
     t3 = await tp.get_token()
     assert t3 == "tok2"

tests/unit/test_decomposition_config.py

@@ -95,7 +95,7 @@ class TestConditionalRequired:
     def test_gateway_happy_path(self):
         s = Settings(
             embedding_provider="gateway",
-            embedding_gateway_url="http://gateway:8083",
+            embedding_gateway_url="https://gateway:8083",
         )
         assert s.embedding_provider == "gateway"
 

tests/unit/vector/test_collection_metadata.py

@@ -45,7 +45,7 @@ async def test_qdrant_error_falls_back_to_env(mocker):
 async def test_api_source(mocker):
     settings = Settings(
         collection_metadata_source="api",
-        collection_metadata_api_url="http://cp",
+        collection_metadata_api_url="https://cp",
     )
 
     def handler(request: httpx.Request) -> httpx.Response:
@@ -85,7 +85,7 @@ async def test_upsert_sentinel_builds_point(mocker):
     point = kwargs["points"][0]
     assert str(point.id) == cm.SENTINEL_POINT_ID
     # Non-zero dense (cosine-safe), empty sparse.
-    assert point.vector["dense"][0] != 0.0
+    assert point.vector["dense"][0] > 0.0
     assert len(point.vector["dense"]) == 4
     assert point.payload[EMBEDDING_IDENTITY] == "mistral-embed"
     assert point.payload[cm.IS_SENTINEL] is True

tests/unit/vector/test_nats_producer.py

@@ -124,7 +124,7 @@ def test_publisher_matches_shared_fixture(mocker):
         ("nats://nats:4222", "nats"),
         ("postgres://h/db", "postgres"),
         ("postgresql://h/db", "postgres"),
-        ("http://elsewhere", "nats"),
+        ("https://elsewhere", "nats"),
     ],
 )
 def test_transport_for(url, expected):