fix: make Vaultwarden cache refresh durable

tests/test_app.py

@@ -42,7 +42,7 @@ def test_health_exposes_current_version():
     with TestClient(app.app) as client:
         response = client.get("/health")
     assert response.status_code == 200
-    assert response.json()["version"] == app.VERSION == "2.3.1"
+    assert response.json()["version"] == app.VERSION == "2.3.2"
 
 
 def test_invalid_log_target_is_rejected_before_ssh():

tests/test_vault_sync.py

@@ -0,0 +1,27 @@
+from pathlib import Path
+import re
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_vault_cache_is_a_persistent_named_volume():
+    compose = (ROOT / "compose.yaml").read_text()
+    assert "vault-cache:/data/vault-cache" in compose
+    assert "volumes:\n  vault-cache:" in compose
+
+
+def test_vault_sync_uses_protected_environment_instead_of_embedded_password():
+    script = (ROOT / "vault-sync.sh").read_text()
+    assert '.vault-sync.env' in script
+    assert not re.search(r'export BW_PASSWORD=["\'](?!\$)', script)
+    assert 'BW_CLIENTID' in script
+    assert 'BW_CLIENTSECRET' in script
+    assert 'bw login --apikey' in script
+    assert 'bw unlock --passwordenv BW_PASSWORD' in script
+
+
+def test_vault_sync_runtime_files_are_not_tracked():
+    gitignore = (ROOT / ".gitignore").read_text().splitlines()
+    assert ".vault-sync.env" in gitignore
+    assert "vault-sync.log" in gitignore