feat: complete remaining Go backend modules

tests/settings-go-contract.test.ts

@@ -0,0 +1,21 @@
+import { readFile } from "node:fs/promises";
+import { describe, expect, it } from "vitest";
+
+const fixtureUrl = new URL("../contracts/settings/runtime-v1.json", import.meta.url);
+
+describe("Go runtime settings compatibility fixture", () => {
+  it("freezes the editable whitelist and secret projection rules", async () => {
+    const fixture = JSON.parse(await readFile(fixtureUrl, "utf8"));
+    expect(fixture).toMatchObject({
+      version: 1,
+      fileName: ".env.local",
+      emptySecretInput: "preserve",
+      emptyNonSecretInput: "write-empty",
+      publicSecretValue: "blank",
+      runtimeApplication: "restart-required"
+    });
+    expect(fixture.allowedKeys).toContain("IMAGE_GENERATE_ENGINE");
+    expect(fixture.secretKeys).toContain("ALI_OSS_ACCESS_KEY_SECRET");
+    expect(fixture.allowedKeys).not.toContain("DATABASE_URL");
+  });
+});