feat: add cost-safe AI growth configuration

internal/config/config_test.go

@@ -33,3 +33,26 @@ func TestValidateAPIRequiresIndependentCursorSecret(t *testing.T) {
 		t.Fatal("ValidateAPI() error = nil, want independent secrets error")
 	}
 }
+
+func TestValidateAPIRequiresGrowthBudgetsInProduction(t *testing.T) {
+	t.Parallel()
+	cfg := Config{SessionSecret: "session-secret-that-is-at-least-32-bytes", CursorSecret: "cursor-secret-that-is-at-least-32-bytes", AppEnv: "production", AIGrowthEnabled: true, AvalAIAPIKey: "key", AvalAIModel: "model", AIMaxConcurrent: 4, AICreatePerMinute: 10, AIUncachedScopesPerDay: 5}
+	if err := cfg.ValidateAPI(); err == nil {
+		t.Fatal("ValidateAPI() error = nil, want AI budget error")
+	}
+	cfg.AIDailyRequestBudget, cfg.AIDailyTokenBudget = 10, 10_000
+	if err := cfg.ValidateAPI(); err != nil {
+		t.Fatalf("ValidateAPI() error = %v", err)
+	}
+}
+
+func TestLoadGrowthDefaultsAreCostSafe(t *testing.T) {
+	t.Setenv("DATABASE_URL", "postgresql://example")
+	cfg, err := Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.AIGrowthEnabled || cfg.AIDailyRequestBudget != 0 || cfg.AIDailyTokenBudget != 0 || cfg.AIMaxConcurrent != 4 {
+		t.Fatalf("unsafe AI defaults: %+v", cfg)
+	}
+}