feat: implement OpsBridge CLI (BRIDGE-WP-0001)

Full TDD implementation of the `bridge` CLI tool covering all phases
from BRIDGE-WP-0001: project scaffolding, config loading, state
management, audit logging, health checks, tunnel lifecycle manager, and
all CLI commands (up/down/restart/status/logs). 77 tests, all green.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_config.py

@@ -0,0 +1,130 @@
+"""Tests for config loading."""
+import os
+import textwrap
+
+import pytest
+
+from bridge.config import ConfigError, load_config
+
+
+VALID_YAML = textwrap.dedent("""\
+    tunnels:
+      state-hub-coulombcore:
+        host: coulombcore.local
+        remote_port: 18000
+        local_port: 8000
+        ssh_user: ubuntu
+        ssh_key: ~/.ssh/id_ops
+        actor: agent.claude-coulombcore
+        health_check:
+          url: http://127.0.0.1:18000/health
+          interval_seconds: 30
+          timeout_seconds: 5
+        reconnect:
+          max_attempts: 0
+          backoff_initial: 5
+          backoff_max: 60
+
+    actors:
+      agent.claude-coulombcore:
+        class: automation
+        description: Claude Code agent on CoulombCore
+      operator.bernd:
+        class: human
+        description: Bernd Worsch
+""")
+
+
+@pytest.fixture
+def config_file(tmp_path):
+    f = tmp_path / "tunnels.yaml"
+    f.write_text(VALID_YAML)
+    return f
+
+
+def test_load_valid_config(config_file, monkeypatch):
+    monkeypatch.setenv("BRIDGE_CONFIG", str(config_file))
+    cfg = load_config()
+    assert "state-hub-coulombcore" in cfg.tunnels
+    t = cfg.tunnels["state-hub-coulombcore"]
+    assert t.host == "coulombcore.local"
+    assert t.remote_port == 18000
+    assert t.local_port == 8000
+    assert t.ssh_user == "ubuntu"
+    assert t.actor == "agent.claude-coulombcore"
+
+
+def test_health_check_loaded(config_file, monkeypatch):
+    monkeypatch.setenv("BRIDGE_CONFIG", str(config_file))
+    cfg = load_config()
+    t = cfg.tunnels["state-hub-coulombcore"]
+    assert t.health_check is not None
+    assert t.health_check.url == "http://127.0.0.1:18000/health"
+    assert t.health_check.interval_seconds == 30
+
+
+def test_reconnect_policy_loaded(config_file, monkeypatch):
+    monkeypatch.setenv("BRIDGE_CONFIG", str(config_file))
+    cfg = load_config()
+    t = cfg.tunnels["state-hub-coulombcore"]
+    assert t.reconnect.max_attempts == 0
+    assert t.reconnect.backoff_initial == 5
+    assert t.reconnect.backoff_max == 60
+
+
+def test_actors_loaded(config_file, monkeypatch):
+    monkeypatch.setenv("BRIDGE_CONFIG", str(config_file))
+    cfg = load_config()
+    assert "agent.claude-coulombcore" in cfg.actors
+    a = cfg.actors["agent.claude-coulombcore"]
+    assert a.actor_class == "automation"
+    assert "operator.bernd" in cfg.actors
+
+
+def test_missing_required_field_raises(tmp_path, monkeypatch):
+    f = tmp_path / "bad.yaml"
+    f.write_text(textwrap.dedent("""\
+        tunnels:
+          broken:
+            remote_port: 18000
+            local_port: 8000
+        actors: {}
+    """))
+    monkeypatch.setenv("BRIDGE_CONFIG", str(f))
+    with pytest.raises(ConfigError, match="host"):
+        load_config()
+
+
+def test_invalid_yaml_raises(tmp_path, monkeypatch):
+    f = tmp_path / "bad.yaml"
+    f.write_text("tunnels: [\nnot: valid: yaml")
+    monkeypatch.setenv("BRIDGE_CONFIG", str(f))
+    with pytest.raises(ConfigError):
+        load_config()
+
+
+def test_missing_config_file_raises(tmp_path, monkeypatch):
+    monkeypatch.setenv("BRIDGE_CONFIG", str(tmp_path / "nonexistent.yaml"))
+    with pytest.raises(ConfigError, match="not found"):
+        load_config()
+
+
+def test_tunnel_without_health_check(tmp_path, monkeypatch):
+    f = tmp_path / "tunnels.yaml"
+    f.write_text(textwrap.dedent("""\
+        tunnels:
+          simple:
+            host: host.local
+            remote_port: 9000
+            local_port: 8000
+            ssh_user: ubuntu
+            ssh_key: ~/.ssh/id_rsa
+            actor: operator.bernd
+        actors:
+          operator.bernd:
+            class: human
+            description: Bernd
+    """))
+    monkeypatch.setenv("BRIDGE_CONFIG", str(f))
+    cfg = load_config()
+    assert cfg.tunnels["simple"].health_check is None