test(release-cleanup): 補齊 cleanup/config/main 與新驗證函式測試

新增 cleanupReleases、cleanupOrphanTags 的失敗路徑與分類測試、
loadConfig 環境變數驗證測試、main 整合測試,以及 requireUrl/
requireRepository 與 content-type 檢查測試。測試共 41 項全數通過。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/test/validate.test.js

@@ -1,6 +1,12 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
-import { isEmptyOrNull, requireValue, requireInteger } from '../validate.js'
+import {
+  isEmptyOrNull,
+  requireValue,
+  requireInteger,
+  requireUrl,
+  requireRepository,
+} from '../validate.js'
 
 test('isEmptyOrNull 對空值回傳 true', () => {
   assert.equal(isEmptyOrNull(''), true)
@@ -35,3 +41,26 @@ test('requireInteger 拒絕非整數或負數', () => {
   assert.throws(() => requireInteger('KEEP_COUNT', '1.5'), /non-negative integer/)
   assert.throws(() => requireInteger('KEEP_COUNT', 'abc'), /non-negative integer/)
 })
+
+test('requireUrl 接受 http/https URL', () => {
+  assert.doesNotThrow(() => requireUrl('URL', 'https://gitea.example.com'))
+  assert.doesNotThrow(() => requireUrl('URL', 'http://localhost:3000'))
+})
+
+test('requireUrl 拒絕非法 URL 或非 http(s) 協定', () => {
+  assert.throws(() => requireUrl('URL', 'not a url'), /must be a valid URL/)
+  assert.throws(() => requireUrl('URL', 'ftp://example.com'), /http or https/)
+  assert.throws(() => requireUrl('URL', 'file:///etc/passwd'), /http or https/)
+})
+
+test('requireRepository 接受合法 owner/repo', () => {
+  assert.doesNotThrow(() => requireRepository('REPO', 'owner/repo'))
+  assert.doesNotThrow(() => requireRepository('REPO', 'my-org/my_repo.git'))
+})
+
+test('requireRepository 拒絕路徑穿越或格式錯誤', () => {
+  assert.throws(() => requireRepository('REPO', '../evil'), /owner\/repo/)
+  assert.throws(() => requireRepository('REPO', 'owner/repo/extra'), /owner\/repo/)
+  assert.throws(() => requireRepository('REPO', 'noslash'), /owner\/repo/)
+  assert.throws(() => requireRepository('REPO', 'owner/..'), /owner\/repo/)
+})