feat: scaffold encryption capability boundaries

tests/test_manifest.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+import unittest
+
+from govoplan_encryption.backend.manifest import (
+    ADMIN_SCOPE,
+    RECOVERY_SCOPE,
+    USE_SCOPE,
+    get_manifest,
+)
+
+
+class EncryptionManifestTests(unittest.TestCase):
+    def test_manifest_is_an_optional_contract_only_seed(self) -> None:
+        manifest = get_manifest()
+
+        self.assertEqual(manifest.id, "encryption")
+        self.assertEqual(manifest.dependencies, ())
+        self.assertIn("access", manifest.optional_dependencies)
+        self.assertEqual(
+            {permission.scope for permission in manifest.permissions},
+            {USE_SCOPE, ADMIN_SCOPE, RECOVERY_SCOPE},
+        )
+        self.assertEqual(
+            {provider.name for provider in manifest.provides_interfaces},
+            {
+                "encryption.key_vault",
+                "encryption.content_protection",
+                "encryption.recovery_ceremony",
+                "encryption.disable_preflight",
+            },
+        )
+        self.assertIsNone(manifest.route_factory)
+        self.assertIsNone(manifest.migration_spec)
+        self.assertIsNone(manifest.frontend)
+
+
+if __name__ == "__main__":
+    unittest.main()