Phase 2: tests for the provider layer and other exposed pure helpers

66 new tests across 8 files (93 total in the suite now):

- GitSyncServiceTests: convertToSSH/injectCredentials/sanitizeFilename/
  detectSecretsInText, including a below-threshold false-positive check
  on the secret regex.
- ChatViewModelPureLogicTests: detectGoodbyePhrase, inferProvider,
  calculateCost -- including the cache-read (0.1x) / cache-write (1.25x)
  pricing multipliers, which is real billing-affecting logic.
- EmbeddingServiceTests / ContextSelectionServiceTests: embedding
  (de)serialization round-trip, importance-score weighting, and the
  token-estimate fallback (content.count / 4) when no real count exists.
- OpenRouterProviderTests / OllamaProviderTests / OpenAIProviderTests /
  AnthropicProviderTests: request-building (attachments, online mode,
  cache_control breakpoints, o1/o3 temperature omission, tool schema
  conversion) and response-parsing (text, tool_use blocks, empty-choices
  fallback behavior) for all four providers, with no network involved.

Also marks calculateCost/inferProvider/detectGoodbyePhrase (ChatViewModel)
and serializeEmbedding/deserializeEmbedding (EmbeddingService) as
`nonisolated` -- discovered via the actual test failures, not
speculation: the project's `SWIFT_DEFAULT_ACTOR_ISOLATION = MainActor`
setting isolates the classes that carry an explicit `@MainActor`
(ChatViewModel), so calling their static members from a plain
synchronous @Test needs the pure ones marked `nonisolated`. Matches
the existing convention already used elsewhere in EmbeddingService
(cosineSimilarity was already nonisolated before this change).

Phase 2 of the test-suite rollout plan (peaceful-baking-kurzweil).

oAITests/GitSyncServiceTests.swift

@@ -0,0 +1,94 @@
+//
+//  GitSyncServiceTests.swift
+//  oAITests
+//
+// SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0
+// Copyright (C) 2026 Rune Olsen
+
+import Testing
+@testable import oAI
+
+@Suite("GitSyncService pure helpers")
+struct GitSyncServiceTests {
+
+    private var service: GitSyncService { GitSyncService.shared }
+
+    // MARK: - convertToSSH
+
+    @Test("Already-SSH URLs pass through unchanged")
+    func convertToSSHAlreadySSH() {
+        #expect(service.convertToSSH("git@github.com:user/repo.git") == "git@github.com:user/repo.git")
+    }
+
+    @Test("HTTPS URL converts to SSH form")
+    func convertToSSHFromHTTPS() {
+        #expect(service.convertToSSH("https://gitlab.pm/rune/oAI-Sync.git") == "git@gitlab.pm:rune/oAI-Sync.git")
+    }
+
+    @Test("HTTP URL converts to SSH form")
+    func convertToSSHFromHTTP() {
+        #expect(service.convertToSSH("http://example.com/user/repo.git") == "git@example.com:user/repo.git")
+    }
+
+    @Test("Malformed URL with no path segment is returned unchanged")
+    func convertToSSHMalformedNoSlash() {
+        #expect(service.convertToSSH("https://onlyhost") == "https://onlyhost")
+    }
+
+    @Test("Unknown scheme is returned unchanged")
+    func convertToSSHUnknownScheme() {
+        #expect(service.convertToSSH("ftp://example.com/repo") == "ftp://example.com/repo")
+    }
+
+    // MARK: - injectCredentials
+
+    @Test("Injects username and password into an HTTPS URL")
+    func injectCredentialsHTTPS() {
+        let result = service.injectCredentials("https://gitlab.pm/rune/repo.git", username: "rune", password: "secret")
+        #expect(result == "https://rune:secret@gitlab.pm/rune/repo.git")
+    }
+
+    @Test("Non-HTTPS URLs are returned unchanged (credentials not injected)")
+    func injectCredentialsNonHTTPS() {
+        let result = service.injectCredentials("git@gitlab.pm:rune/repo.git", username: "rune", password: "secret")
+        #expect(result == "git@gitlab.pm:rune/repo.git")
+    }
+
+    // MARK: - sanitizeFilename
+
+    @Test("Strips filesystem-invalid characters, replacing each with a dash")
+    func sanitizeFilenameStripsInvalidChars() {
+        #expect(service.sanitizeFilename("a/b\\c:d*e?f\"g<h>i|j") == "a-b-c-d-e-f-g-h-i-j")
+    }
+
+    @Test("Leaves an already-valid filename untouched")
+    func sanitizeFilenameValidInput() {
+        #expect(service.sanitizeFilename("My Chat 2026-01-15") == "My Chat 2026-01-15")
+    }
+
+    // MARK: - detectSecretsInText
+
+    @Test("Detects an OpenAI-style API key")
+    func detectSecretsOpenAIKey() {
+        let text = "here's my key: sk-abcdefghijklmnopqrstuvwxyz123456"
+        #expect(service.detectSecretsInText(text).contains("OpenAI Key"))
+    }
+
+    @Test("Detects a GitHub personal access token")
+    func detectSecretsGitHubToken() {
+        let text = "token=ghp_abcdefghijklmnopqrstuvwxyz1234567890"
+        #expect(service.detectSecretsInText(text).contains("Access Token"))
+    }
+
+    @Test("Plain conversational text has no detected secrets")
+    func detectSecretsCleanText() {
+        #expect(service.detectSecretsInText("Just a normal conversation about the weather.").isEmpty)
+    }
+
+    @Test("Does not flag an OpenAI-shaped string one character short of the length threshold")
+    func detectSecretsJustBelowThreshold() {
+        // "sk-" + 31 chars = 34 total, but the pattern requires 32+ chars after "sk-"
+        let shortKey = "sk-" + String(repeating: "a", count: 31)
+        #expect(!service.detectSecretsInText(shortKey).contains("OpenAI Key"))
+    }
+}