fix: harden request handling, pipeline containment, and startup boundaries

backend/tests/test_health.py

@@ -1,7 +1,11 @@
 """Smoke test for the application factory."""
 
+from unittest.mock import AsyncMock, Mock
+
+import pytest
 from fastapi.testclient import TestClient
 
+from app.config import Settings
 from app.main import create_app
 
 
@@ -10,3 +14,16 @@ def test_health_reports_mode() -> None:
     response = client.get("/api/health")
     assert response.status_code == 200
     assert response.json()["mode"] in ("live", "demo")
+
+
+def test_anthropic_client_uses_configured_timeout(monkeypatch: pytest.MonkeyPatch) -> None:
+    anthropic_client = Mock()
+    anthropic_client.close = AsyncMock()
+    constructor = Mock(return_value=anthropic_client)
+    monkeypatch.setattr("app.main.AsyncAnthropic", constructor)
+
+    with TestClient(create_app(Settings(llm_timeout_seconds=42.0))) as client:
+        response = client.get("/api/health")
+
+    assert response.status_code == 200
+    constructor.assert_called_once_with(api_key="unused-demo-key", timeout=42.0)