feat: deliver Sense audits to Bell (T-016)

Sense/internal/config/config_test.go

@@ -166,3 +166,31 @@ func TestValidateControlAPINonLoopbackNeedsSeparateRiskAcceptance(t *testing.T)
 		t.Fatalf("explicit non-loopback Control API risk acceptance failed: %v", err)
 	}
 }
+
+func TestValidateAuditRelaySecurityBoundary(t *testing.T) {
+	base := Config{
+		HTTPAddress: "127.0.0.1:8080", DatabaseDriver: "postgres",
+		DatabaseDSN: "postgres://sense-runtime@127.0.0.1/yovision?sslmode=disable",
+		MediaMTXURL: "http://127.0.0.1:9997", ReconcileInterval: time.Second, ProbeInterval: time.Second,
+		AuditRelayEnabled: true, AuditRelayURL: "http://127.0.0.1:8081/internal/v1/audit-events:batch",
+		AuditRelayKeyFile: filepath.Join(t.TempDir(), "relay-keys.json"), AuditRelayKeyID: "sense-a", AuditRelayInterval: time.Second,
+	}
+	if err := base.Validate(); err != nil {
+		t.Fatalf("valid loopback relay rejected: %v", err)
+	}
+	remoteHTTP := base
+	remoteHTTP.AuditRelayURL = "http://bell.example/internal/v1/audit-events:batch"
+	if err := remoteHTTP.Validate(); err == nil {
+		t.Fatal("remote plaintext relay was accepted")
+	}
+	sqlite := base
+	sqlite.DatabaseDriver, sqlite.DatabaseDSN = "sqlite", "file:test.db"
+	if err := sqlite.Validate(); err == nil {
+		t.Fatal("SQLite audit relay was accepted")
+	}
+	relativeKey := base
+	relativeKey.AuditRelayKeyFile = "relay-keys.json"
+	if err := relativeKey.Validate(); err == nil {
+		t.Fatal("repository-relative relay key was accepted")
+	}
+}