test: close coverage gaps + opt-in integration smoke

Unit-Tests (kein Docker nötig), 130 Tests gesamt:
- config: ${ENV}- und ~-Expansion in hf_home
- prompt_io: _pin_dns (DNS-Rebinding wird abgewiesen, andere Hosts unberührt,
  Resolver wird wiederhergestellt)
- actions: do_check (running/healthy, missing), do_start non-dry-run
  (Happy-Path + Readiness-Fehler mit --logs), _container_lock Force-Bypass
- cli: --max-tokens <= 0 abgelehnt, --expose/--no-expose

scripts/smoke.sh: opt-in End-to-End-Test gegen echten Docker + llama.cpp-Server
(--api-key-Round-Trip inkl. 401/200, start/check/chat/stream/stop, eigener
Container/Port, Cleanup-Trap).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_prompt_urls.py

@@ -5,6 +5,7 @@ import pytest
 
 from llamacppctl.prompt_io import (
     PromptSourceError,
+    _pin_dns,
     load_text_url,
     validate_url_target,
 )
@@ -175,6 +176,41 @@ def test_reject_redirect_by_default(monkeypatch, policy):
         load_text_url("https://example.org/x.txt", policy)
 
 
+def test_pin_dns_allows_validated_ip(monkeypatch):
+    monkeypatch.setattr(
+        socket, "getaddrinfo", _fake_getaddrinfo_factory({"host.example": ["1.2.3.4"]})
+    )
+    with _pin_dns("host.example", ["1.2.3.4"]):
+        assert socket.getaddrinfo("host.example", 443)  # not filtered away
+
+
+def test_pin_dns_rejects_rebound_ip(monkeypatch):
+    # Simulate DNS rebinding: after validation to 1.2.3.4, DNS now returns a
+    # private IP; the pin must refuse it during the actual connect.
+    monkeypatch.setattr(
+        socket, "getaddrinfo", _fake_getaddrinfo_factory({"host.example": ["10.0.0.9"]})
+    )
+    with _pin_dns("host.example", ["1.2.3.4"]):
+        with pytest.raises(socket.gaierror):
+            socket.getaddrinfo("host.example", 443)
+
+
+def test_pin_dns_does_not_touch_other_hosts(monkeypatch):
+    monkeypatch.setattr(
+        socket, "getaddrinfo", _fake_getaddrinfo_factory({"other.example": ["9.9.9.9"]})
+    )
+    with _pin_dns("host.example", ["1.2.3.4"]):
+        assert socket.getaddrinfo("other.example", 443)  # unrelated host passes
+
+
+def test_pin_dns_restores_resolver(monkeypatch):
+    sentinel = _fake_getaddrinfo_factory({"host.example": ["1.2.3.4"]})
+    monkeypatch.setattr(socket, "getaddrinfo", sentinel)
+    with _pin_dns("host.example", ["1.2.3.4"]):
+        pass
+    assert socket.getaddrinfo is sentinel  # restored after the context
+
+
 def test_revalidate_redirect_target(monkeypatch, policy):
     strict_policy = replace(policy, follow_redirects=True)
     monkeypatch.setattr(