Phase1 skeleton: replace demo main.py with src.server contract

- Overlay ModelHub XC Phase1 (health/status, STRATEGY_ID gate, dry-run)
- Dockerfile CMD -> python -m src.server; FROM stays platform TCR base
- Remove demo main.py and requirements.txt (stdlib only)
- Add tests/, scripts/, docs/, Makefile, config/examples (no secrets)

tests/test_health.py

@@ -0,0 +1,60 @@
+"""Tests for /health and /status handlers."""
+
+from __future__ import annotations
+
+import json
+import os
+import unittest
+from unittest import mock
+
+from src.health import handle_get, health_payload, status_payload
+
+
+class TestHealth(unittest.TestCase):
+    def test_health_payload(self) -> None:
+        self.assertEqual(health_payload(), {"status": "ok"})
+
+    def test_handle_get_health(self) -> None:
+        code, headers, body = handle_get("/health")
+        self.assertEqual(code, 200)
+        self.assertIn("application/json", headers["Content-Type"])
+        data = json.loads(body.decode("utf-8"))
+        self.assertEqual(data, {"status": "ok"})
+
+    def test_handle_get_unknown(self) -> None:
+        code, _, body = handle_get("/nope")
+        self.assertEqual(code, 404)
+        self.assertIn("not_found", body.decode("utf-8"))
+
+    def test_status_booleans_only_no_secret_values(self) -> None:
+        with mock.patch.dict(
+            os.environ,
+            {
+                "STRATEGY_ID": "secret-strategy-id-xyz",
+                "EXTERNAL_SERVICE_TOKEN": "secret-token-abc",
+            },
+            clear=False,
+        ):
+            payload = status_payload()
+        self.assertTrue(payload["strategy_id_present"])
+        self.assertTrue(payload["external_service_token_present"])
+        blob = json.dumps(payload)
+        self.assertNotIn("secret-strategy-id-xyz", blob)
+        self.assertNotIn("secret-token-abc", blob)
+
+    def test_status_absent(self) -> None:
+        env = {k: v for k, v in os.environ.items() if k not in (
+            "STRATEGY_ID",
+            "EXTERNAL_SERVICE_TOKEN",
+            "XC_TOKEN",
+            "XC_TOKEN_FILE",
+            "MODELHUB_XC_TOKEN",
+        )}
+        with mock.patch.dict(os.environ, env, clear=True):
+            payload = status_payload()
+        self.assertFalse(payload["strategy_id_present"])
+        self.assertFalse(payload["external_service_token_present"])
+
+
+if __name__ == "__main__":
+    unittest.main()