feat: strengthen module contracts and shared WebUI runtime

tests/test_query_metrics.py

@@ -15,6 +15,55 @@ from govoplan_core.server.fastapi import create_govoplan_app
 
 
 class QueryMetricsTests(TestCase):
+    def test_non_sqlite_engine_uses_bounded_pool_configuration(self) -> None:
+        configured = {
+            "GOVOPLAN_DB_POOL_SIZE": "8",
+            "GOVOPLAN_DB_MAX_OVERFLOW": "16",
+            "GOVOPLAN_DB_POOL_TIMEOUT_SECONDS": "45",
+            "GOVOPLAN_DB_POOL_RECYCLE_SECONDS": "900",
+        }
+        engine = object()
+        with (
+            patch.dict(os.environ, configured, clear=False),
+            patch(
+                "govoplan_core.db.session.create_engine",
+                return_value=engine,
+            ) as create_engine,
+            patch(
+                "govoplan_core.db.session.instrument_engine",
+                side_effect=lambda value: value,
+            ),
+        ):
+            result = create_database_engine(
+                "postgresql+psycopg://govoplan@example/govoplan",
+            )
+
+        self.assertIs(engine, result)
+        create_engine.assert_called_once_with(
+            "postgresql+psycopg://govoplan@example/govoplan",
+            pool_pre_ping=True,
+            connect_args={},
+            pool_size=8,
+            max_overflow=16,
+            pool_timeout=45,
+            pool_recycle=900,
+        )
+
+    def test_non_sqlite_engine_rejects_pool_values_outside_safe_bounds(self) -> None:
+        invalid_values = (
+            ("GOVOPLAN_DB_POOL_SIZE", "0"),
+            ("GOVOPLAN_DB_MAX_OVERFLOW", "201"),
+            ("GOVOPLAN_DB_POOL_TIMEOUT_SECONDS", "not-a-number"),
+            ("GOVOPLAN_DB_POOL_RECYCLE_SECONDS", "86401"),
+        )
+        for name, value in invalid_values:
+            with self.subTest(name=name, value=value):
+                with patch.dict(os.environ, {name: value}, clear=False):
+                    with self.assertRaisesRegex(ValueError, name):
+                        create_database_engine(
+                            "postgresql+psycopg://govoplan@example/govoplan",
+                        )
+
     def test_collect_query_metrics_counts_instrumented_engine_queries(self) -> None:
         engine = create_database_engine("sqlite:///:memory:")
         try: