test: Cover weak RSA path and split resolvePort helper

Adds a 1024-bit RSA fixture and PemSslContextTest case that exercises
the minimum-strength guard, lifting new-code coverage on PR 91 above
the 80% Sonar gate. Splits the nested ternary in OpenApiServer.Builder
into a resolvePort() helper to clear the matching SonarLint finding.

Author: thced

src/main/java/com/retailsvc/http/OpenApiServer.java

@@ -390,8 +390,7 @@ public OpenApiServer build() throws IOException {
               Map.copyOf(securityValidators),
               externalAuth,
               List.copyOf(afterHooks));
-      int resolvedPort =
-          port != null ? port : (httpsCertChain != null ? DEFAULT_HTTPS_PORT : DEFAULT_PORT);
+      int resolvedPort = resolvePort();
       SSLContext sslContext =
           httpsCertChain != null ? PemSslContext.load(httpsCertChain, httpsPrivateKey) : null;
       return new OpenApiServer(
@@ -404,6 +403,13 @@ public OpenApiServer build() throws IOException {
           sslContext);
     }
 
+    private int resolvePort() {
+      if (port != null) {
+        return port;
+      }
+      return httpsCertChain != null ? DEFAULT_HTTPS_PORT : DEFAULT_PORT;
+    }
+
     private static void validateHandlerWiring(Spec spec, Map<String, RequestHandler> handlers) {
       Set<String> specOps = new TreeSet<>();
       for (Operation op : spec.operations()) {

src/test/java/com/retailsvc/http/internal/PemSslContextTest.java

@@ -17,6 +17,8 @@ class PemSslContextTest {
   private static final Path MISMATCHED_KEY = Path.of("src/test/resources/tls/mismatched-key.pem");
   private static final Path GARBAGE = Path.of("src/test/resources/tls/garbage.pem");
   private static final Path MISSING = Path.of("src/test/resources/tls/does-not-exist.pem");
+  private static final Path WEAK_RSA_CERT = Path.of("src/test/resources/tls/weak-rsa-cert.pem");
+  private static final Path WEAK_RSA_KEY = Path.of("src/test/resources/tls/weak-rsa-key.pem");
 
   @Test
   void loadsRsaPemPair() throws Exception {
@@ -91,4 +93,12 @@ void acceptsEcKeyAtMinimumStrength() throws Exception {
     SSLContext ctx = PemSslContext.load(EC_CERT, EC_KEY);
     assertThat(ctx).isNotNull();
   }
+
+  @Test
+  void rejectsWeakRsaKey() {
+    assertThatThrownBy(() -> PemSslContext.load(WEAK_RSA_CERT, WEAK_RSA_KEY))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessageContaining("TLS RSA key below minimum strength")
+        .hasMessageContaining("1024 bits");
+  }
 }

src/test/resources/tls/weak-rsa-cert.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICGDCCAYGgAwIBAgIUROGXccQOoJe1ANi92SDG+ghoRe4wDQYJKoZIhvcNAQEL
+BQAwHTEbMBkGA1UEAwwSd2Vhay1yc2EtbG9jYWxob3N0MCAXDTI2MDUyMTA4NTUw
+MVoYDzIxMjYwNDI3MDg1NTAxWjAdMRswGQYDVQQDDBJ3ZWFrLXJzYS1sb2NhbGhv
+c3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK50Oy2AQ9HLGNRf8ncZ11Y1
+H9hewBbSqPW5vw0To//KxdzpSAprW1C37ZXBHTT1eiDqgr247GxTWBo6axCtLHq3
+uh5ODdqcXSdGxu2KbMu2Pa+0IYJvmgrwN8uBT+j0FtjCQxokni3l7Qhs7amNnTag
+ToSlGUzQE2nhAeV+IyohAgMBAAGjUzBRMB0GA1UdDgQWBBTV4Fiz8I5WXeQxzPU3
+pJLLVLhKaTAfBgNVHSMEGDAWgBTV4Fiz8I5WXeQxzPU3pJLLVLhKaTAPBgNVHRMB
+Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GBAD4K1YYaJ00lKiQKHF/gKpoRzgzl
+8P5qbChHEtv46Nj4govB2QuoW0d1SHVSS15bnQ90doeEDF/MExossoC8W4b4i+7I
+LeyMMOB5wCFQntIslci+Ec/5z9mrWqf8EK4V6j2DIXKaEpQszApU0NnASwgmvyfP
+6r6aiu7Z4Izibc6P
+-----END CERTIFICATE-----

src/test/resources/tls/weak-rsa-key.pem

@@ -0,0 +1,16 @@
+-----BEGIN PRIVATE KEY-----
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAK50Oy2AQ9HLGNRf
+8ncZ11Y1H9hewBbSqPW5vw0To//KxdzpSAprW1C37ZXBHTT1eiDqgr247GxTWBo6
+axCtLHq3uh5ODdqcXSdGxu2KbMu2Pa+0IYJvmgrwN8uBT+j0FtjCQxokni3l7Qhs
+7amNnTagToSlGUzQE2nhAeV+IyohAgMBAAECgYAakY8VrewmPlUouvgVVXUrJuoT
+rNJ6Z1jeG4zSNASNB1e8/jY/h/wfPfPME94b26re6nhA5rHzCXpofC8kGguk4Gwz
+FFSC+x21L37xFIGvSwv89DvL9cRA7RXZmhNWzsf5M730EOx5F2ffwyczsp0U0KXU
+0nh6Qx5BHDNSMZVHNQJBAOBT4YDibOINikJx7ciKje9MgQTcUztXhOWcN6jmn4Km
+AIo5yiLYgryW0gILpcnhQNMQfXDRc6Cbb7CI0KmNq78CQQDHFbaX/BK1wOVkddCN
+XHZxKmEHBV2JdZ+udSNaF8CnxTq3ooRvozJBpxQmbWTMaL6jZIPMSwKRM+ZTWBzV
+1CIfAkApXo65rAgUcBbNRiFp2FNwjBVHBjK7QNqbVYHWPiGwgFidJScn4fHKQa4c
+/nTmlAnWYrYfdiDyv3eLgM+qVRwVAkEAn6n6VsoC92FMl9Uk/To6g2fJiSf0bFm5
+RuELCSYjjGnRPZVJQX9QvvaQYoE5ZfZbbg8e5KkD1hAZmJ4CAjuvYQJBALI5HaIn
+ujOcOSVEK2NOIOH4JdtmoTx2O0IImYX3svje3h41Uj0+zh8bWRvejpdwU4Z7p/YL
+rh/zmtMxXQZadgM=
+-----END PRIVATE KEY-----