feat: enforce production pricing provider config

apps/api/src/app/server.js

@@ -51,7 +51,10 @@ import { createProviderMappingRepository } from "../modules/pricing/repositories
 import { createProviderMappingService } from "../modules/pricing/services/provider-mapping-service.js";
 import { createPricingProviderRegistry } from "../modules/pricing/providers/pricing-provider.js";
 import { createFixturePricingProvider } from "../modules/pricing/providers/fixture-pricing-provider.js";
-import { createHttpPricingProvider } from "../modules/pricing/providers/http-pricing-provider.js";
+import {
+  assertProductionPricingProviderConfig,
+  createHttpPricingProvider,
+} from "../modules/pricing/providers/http-pricing-provider.js";
 import { createAdminExportService } from "../modules/exports/services/admin-export-service.js";
 import { createInventoryExportJobRepository } from "../modules/exports/repositories/inventory-export-job-repository.js";
 import { createSellerSettingsRepository } from "../modules/settings/repositories/seller-settings-repository.js";
@@ -70,6 +73,12 @@ function parsePort(value) {
 }
 
 async function startServer() {
+  if (process.env.NODE_ENV === "production") {
+    assertProductionPricingProviderConfig({
+      fixtureEnabled: process.env.PRICING_FIXTURE_PROVIDER_ENABLED === "true",
+      endpoint: process.env.PRICING_HTTP_PROVIDER_ENDPOINT,
+    });
+  }
   const imageStorageRoot = resolveProjectImageStorageRoot(
     process.env.IMAGE_STORAGE_ROOT ?? ".local/image-storage",
     import.meta.url,

apps/api/src/modules/pricing/providers/http-pricing-provider.js

@@ -1,5 +1,23 @@
 import { createPricingProvider } from './pricing-provider.js';
 
+export function assertProductionPricingProviderConfig({ fixtureEnabled, endpoint }) {
+  if (fixtureEnabled) {
+    throw new Error('The fixture pricing provider must be disabled in production.');
+  }
+  if (typeof endpoint !== 'string' || endpoint.trim().length === 0) {
+    throw new Error('A production pricing provider endpoint is required.');
+  }
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(endpoint);
+  } catch {
+    throw new Error('The production pricing provider endpoint must be a valid HTTPS URL.');
+  }
+  if (parsedUrl.protocol !== 'https:') {
+    throw new Error('The production pricing provider endpoint must use HTTPS.');
+  }
+}
+
 export function createHttpPricingProvider({
   id,
   endpoint,