feat: initial public release

ConsentOS — a privacy-first cookie consent management platform.

Self-hosted, source-available alternative to OneTrust, Cookiebot, and
CookieYes. Full standards coverage (IAB TCF v2.2, GPP v1, Google
Consent Mode v2, GPC, Shopify Customer Privacy API), multi-tenant
architecture with role-based access, configuration cascade
(system → org → group → site → region), dark-pattern detection in
the scanner, and a tamper-evident consent record audit trail.

This is the initial public release. Prior development history is
retained internally.

See README.md for the feature list, architecture overview, and
quick-start instructions. Licensed under the Elastic Licence 2.0 —
self-host freely; do not resell as a managed service.

apps/api/tests/test_settings.py

@@ -0,0 +1,37 @@
+"""Tests for application settings parsing."""
+
+from src.config.settings import Settings
+
+
+class TestAllowedOrigins:
+    """Tests for the allowed_origins_list property."""
+
+    def test_comma_separated_string(self) -> None:
+        """Comma-separated string is parsed into a list."""
+        settings = Settings(allowed_origins="https://a.com,https://b.com")
+        assert settings.allowed_origins_list == ["https://a.com", "https://b.com"]
+
+    def test_comma_separated_with_spaces(self) -> None:
+        """Whitespace around commas is stripped."""
+        settings = Settings(allowed_origins="https://a.com , https://b.com")
+        assert settings.allowed_origins_list == ["https://a.com", "https://b.com"]
+
+    def test_single_origin_string(self) -> None:
+        """A single origin string (no comma) is a single-element list."""
+        settings = Settings(allowed_origins="https://a.com")
+        assert settings.allowed_origins_list == ["https://a.com"]
+
+    def test_empty_string(self) -> None:
+        """An empty string results in an empty list."""
+        settings = Settings(allowed_origins="")
+        assert settings.allowed_origins_list == []
+
+    def test_trailing_comma_ignored(self) -> None:
+        """Trailing commas don't produce empty entries."""
+        settings = Settings(allowed_origins="https://a.com,")
+        assert settings.allowed_origins_list == ["https://a.com"]
+
+    def test_default_value(self) -> None:
+        """Default value is localhost:5173."""
+        settings = Settings()
+        assert settings.allowed_origins_list == ["http://localhost:5173"]