Harden NordVPN reconciliation and WebGUI testing

tests/unit/ReconcilerTest.php

@@ -1,6 +1,7 @@
 <?php
 
 use OPNsense\NordVPN\ManagedConfiguration;
+use OPNsense\NordVPN\EndpointStore;
 use OPNsense\NordVPN\NordApi;
 use OPNsense\NordVPN\Reconciler;
 use OPNsense\NordVPN\Settings;
@@ -104,6 +105,19 @@ class UnavailableReconcilerHealth extends TunnelHealth
     }
 }
 
+class FailingReconcilerEndpointStore extends EndpointStore
+{
+    public function refreshIfStale(NordApi $api): bool
+    {
+        throw new RuntimeException('Synthetic endpoint failure.');
+    }
+
+    public function available(): bool
+    {
+        return false;
+    }
+}
+
 class FailOnceReconcilerRunner extends SystemRunner
 {
     public int $firewallCalls = 0;
@@ -252,6 +266,31 @@ final class ReconcilerTest extends TestCase
         unlink($path);
     }
 
+    public function testEndpointRefreshFailureDoesNotDelayAvailableStatus(): void
+    {
+        $path = $this->temporaryStatusPath();
+        $configuration = new ReconcilerTestConfiguration();
+        $configuration->settings()->general->exempt_wireguard = '1';
+
+        $result = (new Reconciler(
+            new NordApi(static fn() => []),
+            $configuration,
+            new AvailableReconcilerHealth(),
+            new StatusStore($path),
+            new RepairReconcilerRunner(),
+            null,
+            new FailingReconcilerEndpointStore()
+        ))->run();
+
+        $this->assertTrue($result['available']);
+        $this->assertSame('available', $result['state']);
+        $this->assertSame(
+            'NordVPN endpoint refresh failed; the WireGuard exemption is inactive.',
+            $result['endpoint_message']
+        );
+        unlink($path);
+    }
+
     private function temporaryStatusPath(): string
     {
         return sys_get_temp_dir() . '/nordvpn-reconciler-' . bin2hex(random_bytes(8)) . '.json';