Heavy security and file splitting

cmd/scratchbox/main_test.go

@@ -347,6 +347,16 @@ func TestGenerateConfigCommandWritesDefaultYAML(t *testing.T) {
 	if !cfg.Security.RateLimitAPIWrite.Enabled {
 		t.Fatalf("security.rate_limit_api_write.enabled = %v, want true", cfg.Security.RateLimitAPIWrite.Enabled)
 	}
+	// Additional assertions act as golden checks against generate drift in defaults/comments/struct.
+	if cfg.Storage.CleanupInterval != "1m" {
+		t.Fatalf("storage.cleanup_interval = %q, want %q", cfg.Storage.CleanupInterval, "1m")
+	}
+	if !cfg.Security.HSTSEnabled {
+		t.Fatalf("security.hsts_enabled = %v, want true", cfg.Security.HSTSEnabled)
+	}
+	if cfg.Limits.RawCacheMaxEntries != 32 {
+		t.Fatalf("limits.raw_cache_max_entries = %d, want 32", cfg.Limits.RawCacheMaxEntries)
+	}
 }
 
 func TestGenerateConfigCommandRejectsUnexpectedArgs(t *testing.T) {
@@ -437,6 +447,9 @@ security:
 	if err != nil {
 		t.Fatalf("config.Load() error = %v", err)
 	}
+	if err := cfg.PrepareDataDir(); err != nil {
+		t.Fatalf("config.PrepareDataDir() error = %v", err)
+	}
 	logger := log.New(io.Discard, "", 0)
 	store, err := storage.NewFilesystemStore(cfg.Storage.DataDir, cfg.Storage.EncryptionKeyBytes)
 	if err != nil {