fix(go): repair migration wire contracts and runtime lifecycle; document incomplete port

internal/gateway/gateway_test.go

@@ -1,6 +1,8 @@
 package gateway
 
 import (
+	"fmt"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -9,6 +11,41 @@ import (
 	"ananta-ps/internal/config"
 )
 
+func TestGatewayReportsBindFailureAndRollsBack(t *testing.T) {
+	blocker, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer blocker.Close()
+	probe, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	listPort := probe.Addr().(*net.TCPAddr).Port
+	probe.Close()
+	cfg := &config.Config{Network: config.NetworkConfig{BindHost: "127.0.0.1", Proxy: config.ProxyConfig{
+		LoginListPort: listPort, HttpPort: blocker.Addr().(*net.TCPAddr).Port,
+	}}}
+	gw := New(cfg, "../../public", "../../certs")
+	if err := gw.Start(); err == nil {
+		gw.Stop()
+		t.Fatal("occupied HTTP port reported as ready")
+	}
+	ln, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", fmt.Sprint(listPort)))
+	if err != nil {
+		t.Fatalf("partial startup leaked login-list listener: %v", err)
+	}
+	ln.Close()
+}
+
+func TestGatewayRequiresUsableTLSCertificate(t *testing.T) {
+	gw := New(&config.Config{}, t.TempDir(), t.TempDir())
+	if err := gw.Start(); err == nil {
+		gw.Stop()
+		t.Fatal("missing certificate silently disabled HTTPS")
+	}
+}
+
 func TestGatewayDispatch(t *testing.T) {
 	cfg := &config.Config{
 		Client: config.ClientConfig{