fix(t233): add redacted ERP diagnostics

backend-api/internal/config/config_test.go

@@ -44,7 +44,7 @@ func TestLoadUsesSafeDefaults(t *testing.T) {
 	}
 	if cfg.ShunyunbaoURL != "https://www.shunyunbaoerp.com" ||
 		cfg.ShunyunbaoUsername != "" || cfg.ShunyunbaoPassword != "" ||
-		cfg.ShunyunbaoTimeout != 30*time.Second {
+		cfg.ShunyunbaoTimeout != 30*time.Second || cfg.ERPDebugLog {
 		t.Fatalf(
 			"shunyunbao defaults = %q / %q / %q / %s",
 			cfg.ShunyunbaoURL,
@@ -68,6 +68,7 @@ func TestLoadAcceptsExplicitConfiguration(t *testing.T) {
 		ShunyunbaoURLEnvironment:      "https://erp.example.test:8443",
 		ShunyunbaoUsernameEnvironment: "service-user",
 		ShunyunbaoPasswordEnvironment: " pass with spaces ",
+		ERPDebugLogEnvironment:        "true",
 	}
 
 	cfg, err := Load(mapEnvironment(values))
@@ -104,7 +105,8 @@ func TestLoadAcceptsExplicitConfiguration(t *testing.T) {
 	}
 	if cfg.ShunyunbaoURL != values[ShunyunbaoURLEnvironment] ||
 		cfg.ShunyunbaoUsername != values[ShunyunbaoUsernameEnvironment] ||
-		cfg.ShunyunbaoPassword != values[ShunyunbaoPasswordEnvironment] {
+		cfg.ShunyunbaoPassword != values[ShunyunbaoPasswordEnvironment] ||
+		!cfg.ERPDebugLog {
 		t.Fatalf("shunyunbao config was not preserved")
 	}
 }
@@ -138,6 +140,12 @@ func TestLoadRejectsUnsafeOrInvalidValues(t *testing.T) {
 				ShunyunbaoPasswordEnvironment: "password",
 			},
 		},
+		{
+			name: "invalid ERP debug log",
+			values: map[string]string{
+				ERPDebugLogEnvironment: "yes",
+			},
+		},
 		{
 			name: "blank explicit address",
 			values: map[string]string{