refactor(tests): address Copilot review on the CI-compat fix

- conftest: set JWT_SECRET when missing OR empty (setdefault would keep an
  explicit JWT_SECRET="", still tripping pyjwt 2.13's empty-key guard).
- smoke: store route methods as an immutable frozenset in _ResolvedRoute
  (a set inside a NamedTuple is mutable and makes the tuple non-hashable).

Author: Zingzy

tests/conftest.py

@@ -22,7 +22,9 @@
 # .env) does not set JWT_SECRET, leaving it "" — and pyjwt >= 2.13 rejects empty
 # HMAC keys ("HMAC key must not be empty."). Provide a non-prod test secret here,
 # before any test module constructs AppSettings(), so signing/verification match.
-os.environ.setdefault("JWT_SECRET", "test-jwt-secret-not-for-production")
+# Set when missing *or* empty (setdefault would keep an explicit JWT_SECRET="").
+if not os.environ.get("JWT_SECRET"):
+    os.environ["JWT_SECRET"] = "test-jwt-secret-not-for-production"
 
 from config import AppSettings
 from middleware.error_handler import register_error_handlers

tests/smoke/test_routes_registered.py

@@ -15,7 +15,7 @@ class _ResolvedRoute(NamedTuple):
     """A flattened API route with its fully-qualified path and HTTP methods."""
 
     path: str
-    methods: set[str]
+    methods: frozenset[str]
 
 
 def _get_api_routes(app: FastAPI) -> list[_ResolvedRoute]:
@@ -34,7 +34,9 @@ def _collect(routes, prefix: str = "") -> list[_ResolvedRoute]:
         found: list[_ResolvedRoute] = []
         for route in routes:
             if isinstance(route, APIRoute):
-                found.append(_ResolvedRoute(prefix + route.path, set(route.methods)))
+                found.append(
+                    _ResolvedRoute(prefix + route.path, frozenset(route.methods))
+                )
             elif hasattr(route, "original_router"):
                 child_prefix = (
                     getattr(getattr(route, "include_context", None), "prefix", "") or ""