feat(deploy): add Contabo release workflow and portal payload gate

www/tools/service-portal.test.mjs

@@ -127,21 +127,26 @@ test('private collector validates binary, reuses hash, rejects errors and unappr
   } finally { await fs.rm(dir, { recursive: true }); }
 });
 
-test('portal input requires every local gate and rejects missing or malformed ciphertext', async () => {
+test('portal input isolates local preview from explicit indexing production payloads', async () => {
   const { readPortalInput } = await import('../src/utils/portal-input.mjs');
   const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'aia-portal-input-'));
   try {
     const pass = randomBytes(24).toString('base64');
     const streams = await Promise.all(['one','two'].map((id) => encryptPortalStream(id, '<p>Synthetic</p>', pass)));
     const file = path.join(dir, 'fixture.json'); await fs.writeFile(file, JSON.stringify({ alg: portalAlgorithm, streams }), { mode: 0o600 });
-    const options = { approved: 'true', indexing: 'false', file };
+    const options = { localApproved: 'true', indexing: 'false', localFile: file };
     assert.ok(readPortalInput(options));
     // Form modes cannot substitute for the independent private-input approval.
     for (const mode of ['live', 'off', 'mock']) {
       assert.ok(readPortalInput({ ...options, mode }));
-      assert.equal(readPortalInput({ indexing: 'false', file, mode }), undefined);
+      assert.equal(readPortalInput({ indexing: 'false', localFile: file, mode }), undefined);
     }
-    for (const changed of [{ approved: undefined }, { approved: 'false' }, { indexing: 'true' }, { indexing: undefined }, { file: '/missing-fixture' }]) assert.equal(readPortalInput({ ...options, ...changed }), undefined);
-    await fs.writeFile(file, '<h1>Not encrypted</h1>'); assert.equal(readPortalInput(options), undefined);
+    for (const changed of [{ localApproved: undefined }, { localApproved: 'false' }]) assert.equal(readPortalInput({ ...options, ...changed }), undefined);
+    assert.throws(() => readPortalInput({ ...options, indexing: 'true' }), /publication mode/);
+    assert.ok(readPortalInput({ productionApproved: 'true', indexing: 'true', productionFile: file }));
+    assert.throws(() => readPortalInput({ productionApproved: 'true', indexing: 'true' }), /required/);
+    assert.throws(() => readPortalInput({ localApproved: 'true', productionApproved: 'true', indexing: 'false', localFile: file, productionFile: file }), /either/);
+    await fs.writeFile(file, '<h1>Not encrypted</h1>');
+    assert.throws(() => readPortalInput(options), /missing or malformed/);
   } finally { await fs.rm(dir, { recursive: true }); }
 });