test(config): assert trusted_hosts by exact list (CodeQL URL-substring false positive)

CodeQL flagged 'myapp.example.com' in cfg.trusted_hosts as incomplete URL
substring sanitization — a false positive on list-membership. Assert exact list
equality instead; same meaning, no heuristic trip.

Author: fgogolli

tests/unit/config/test_server_schema.py

@@ -357,7 +357,9 @@ def test_server_config_trusted_hosts_can_be_overridden():
     from orb.config.schemas.server_schema import ServerConfig
 
     cfg = ServerConfig(trusted_hosts=["myapp.example.com", "localhost"])  # type: ignore[call-arg]
-    assert "myapp.example.com" in cfg.trusted_hosts
+    # Exact list comparison (not substring membership) — asserts the operator
+    # override is preserved verbatim and avoids CodeQL's URL-substring heuristic.
+    assert cfg.trusted_hosts == ["myapp.example.com", "localhost"]
 
 
 # ---------------------------------------------------------------------------