feat(ui): add desktop footer, legal custom link and about dialog

internal/config/config_test.go

@@ -81,3 +81,42 @@ func TestJWTSecretNeverUsesAKnownDefault(t *testing.T) {
 		t.Fatalf("a real JWT_SECRET must win, got %q", got)
 	}
 }
+
+func TestCustomLinkValidation(t *testing.T) {
+	t.Setenv("DATA_DIR", t.TempDir())
+
+	// 1. Valid https URL and label
+	t.Setenv("LEGAL_CUSTOM_LINK_LABEL", "Unternehmensseite")
+	t.Setenv("LEGAL_CUSTOM_LINK_URL", "https://example.com/company")
+	cfg := Load()
+	if cfg.Legal.CustomLinkLabel != "Unternehmensseite" {
+		t.Errorf("expected label 'Unternehmensseite', got %q", cfg.Legal.CustomLinkLabel)
+	}
+	if cfg.Legal.CustomLinkURL != "https://example.com/company" {
+		t.Errorf("expected url 'https://example.com/company', got %q", cfg.Legal.CustomLinkURL)
+	}
+
+	// 2. Insecure http URL -> ignored
+	t.Setenv("LEGAL_CUSTOM_LINK_LABEL", "Insecure Site")
+	t.Setenv("LEGAL_CUSTOM_LINK_URL", "http://insecure.example.com")
+	cfg = Load()
+	if cfg.Legal.CustomLinkURL != "" || cfg.Legal.CustomLinkLabel != "" {
+		t.Errorf("expected empty custom link for http, got url=%q label=%q", cfg.Legal.CustomLinkURL, cfg.Legal.CustomLinkLabel)
+	}
+
+	// 3. Invalid scheme (javascript:) -> ignored
+	t.Setenv("LEGAL_CUSTOM_LINK_LABEL", "Exploit")
+	t.Setenv("LEGAL_CUSTOM_LINK_URL", "javascript:alert(1)")
+	cfg = Load()
+	if cfg.Legal.CustomLinkURL != "" || cfg.Legal.CustomLinkLabel != "" {
+		t.Errorf("expected empty custom link for javascript:, got url=%q label=%q", cfg.Legal.CustomLinkURL, cfg.Legal.CustomLinkLabel)
+	}
+
+	// 4. Empty URL -> empty
+	t.Setenv("LEGAL_CUSTOM_LINK_LABEL", "Only Label")
+	t.Setenv("LEGAL_CUSTOM_LINK_URL", "")
+	cfg = Load()
+	if cfg.Legal.CustomLinkURL != "" || cfg.Legal.CustomLinkLabel != "" {
+		t.Errorf("expected empty custom link when url is empty, got url=%q label=%q", cfg.Legal.CustomLinkURL, cfg.Legal.CustomLinkLabel)
+	}
+}