feat(api): add FAV vault status stub with gated publisher

Expose GET /api/v1/vault/status and only wire in-process Drain when
FAV_PUBLISHER_ENABLED is explicitly true; degraded read stays off by default.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/server/vault_test.go

@@ -0,0 +1,69 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"chat-agent-system/internal/config"
+)
+
+func TestVaultDefaultsStayDisabled(t *testing.T) {
+	cfg, err := config.Load("/dev/null")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.FAVDegradedRead {
+		t.Fatal("FAV_DEGRADED_READ must default false")
+	}
+	if cfg.FAVPublisherEnabled {
+		t.Fatal("FAV_PUBLISHER_ENABLED must default false")
+	}
+
+	s := &Server{cfg: cfg}
+	s.initArtifactVault()
+	s.startVaultPublisher()
+	if s.vaultPub != nil {
+		t.Fatal("vault publisher must stay nil when flag off")
+	}
+	if s.vaultPublisherRunning() {
+		t.Fatal("vault publisher must not start when flag off")
+	}
+	if _, _, err := s.tryVaultDegraded(context.Background(), "dev", "doc", "1"); err == nil {
+		t.Fatal("degraded read must refuse when flag off")
+	}
+}
+
+func TestVaultStatusReportsOff(t *testing.T) {
+	s := &Server{cfg: &config.Config{Env: "dev"}}
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/vault/status", nil)
+	rr := httptest.NewRecorder()
+	s.handleVaultStatus(rr, req)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status=%d", rr.Code)
+	}
+	var body map[string]any
+	if err := json.Unmarshal(rr.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["consumer_mode"] != "off" {
+		t.Fatalf("consumer_mode=%v", body["consumer_mode"])
+	}
+	if body["publisher_enabled"] != false {
+		t.Fatalf("publisher_enabled=%v", body["publisher_enabled"])
+	}
+	if body["degraded_read"] != false {
+		t.Fatalf("degraded_read=%v", body["degraded_read"])
+	}
+}
+
+func TestValidateIndependentVaultRejectsDataRoot(t *testing.T) {
+	if err := config.ValidateIndependentVault("./data/dev", "./data/dev"); err == nil {
+		t.Fatal("expected vault/data collision error")
+	}
+	if err := config.ValidateIndependentVault("", "./data/dev"); err != nil {
+		t.Fatal(err)
+	}
+}