Prepare ForgeFlow for public release

tests/config-store.test.mjs

@@ -193,7 +193,11 @@ test("setup, Gitea updates and generic patches retain normalized public state",
   assert.equal(completed.state.setupComplete, true);
   assert.equal(completed.state.gitea.hasToken, true);
   assert.deepEqual(completed.state.workspaceRoots, ["C:/Projects"]);
-  const update = await store.updateGitea({ baseUrl: "https://new.test", token: "", user: null });
+  await assert.rejects(
+    store.updateGitea({ baseUrl: "https://new.test", token: "", user: null }),
+    (error) => error.code === "GITEA_TOKEN_ORIGIN_CHANGED"
+  );
+  const update = await store.updateGitea({ baseUrl: "https://gitea.test", token: "", user: null });
   assert.equal(update.preserved, true);
   assert.equal(store.data.gitea.user.login, "jens");
   const patched = await store.patch({ appearance: "light", workspaceRoots: ["D:/Code", "D:/Code"] });
@@ -215,6 +219,20 @@ test("server saves reject absent credentials before mutating configuration", asy
   assert.deepEqual(store.data.servers, []);
 });
 
+test("server credentials and trust are cleared when the connection identity changes", async (t) => {
+  const { store } = await storeFixture(t);
+  store.encryptSecret = (value) => `encrypted:${value}`;
+  const saved = await store.saveServer({ host: "server-one", username: "deploy", authType: "password", basePath: "/mnt/apps", hostFingerprint: "SHA256:trusted" }, { password: "test-password" });
+  await assert.rejects(
+    store.saveServer({ ...saved, host: "server-two" }, {}),
+    /password is required/i
+  );
+  assert.equal(store.data.servers[0].host, "server-one");
+  const changed = await store.saveServer({ ...saved, host: "server-two" }, { password: "replacement-password" });
+  assert.equal(changed.hostFingerprint, "");
+  assert.equal(changed.hasPassword, true);
+});
+
 test("deployment profile normalization covers safe defaults and every optional Unraid control", async (t) => {
   const { store } = await storeFixture(t);
   const actions = store.normalizeDeploymentProfile({ environment: "qa", statusUrl: "https://app.test/status" });