test: cover secure speedtest deployment endpoint

tests/test_app.py

@@ -322,3 +322,37 @@ def test_hetzner_token_refreshes_vault_cache_when_missing(monkeypatch):
     assert calls[0][0] == "sascha@10.4.1.116"
     assert calls[0][1] == "sudo bash /data/stacks/homelab-butler/vault-sync.sh"
     assert calls[1] == "reload"
+
+
+def test_speedtest_deploy_requires_strong_password_and_uses_git_compose(monkeypatch):
+    calls = []
+
+    async def fake_fetch(repo, path):
+        calls.append(("fetch", repo, path))
+        return "services:\n  speedtest:\n    image: ghcr.io/librespeed/speedtest:latest\n"
+
+    def fake_deploy(compose, password):
+        calls.append(("deploy", compose, password))
+        return {"status": "deployed", "health": "ok"}
+
+    monkeypatch.setattr(app, "_fetch_forgejo_text", fake_fetch)
+    monkeypatch.setattr(app, "_deploy_speedtest_compose", fake_deploy)
+    with TestClient(app.app) as client:
+        weak = client.post(
+            "/vps/speedtest/deploy",
+            headers={"Authorization": "Bearer test-token"},
+            json={"stats_password": "short"},
+        )
+        response = client.post(
+            "/vps/speedtest/deploy",
+            headers={"Authorization": "Bearer test-token"},
+            json={"stats_password": "correct-horse-battery-staple"},
+        )
+
+    assert weak.status_code == 400
+    assert response.status_code == 200
+    assert response.json()["status"] == "deployed"
+    assert calls == [
+        ("fetch", "sascha/speedtest", "compose.yaml"),
+        ("deploy", "services:\n  speedtest:\n    image: ghcr.io/librespeed/speedtest:latest\n", "correct-horse-battery-staple"),
+    ]