✅ test: add 4 new tests for untested code paths

- Concurrent saves preserve both hosters and globalSettings (write queue)
- Backup recovery when main config file is corrupted (.bak fallback)
- encrypt() rejects empty/null/undefined password
- decrypt() rejects empty/null password

All 63 tests passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/backup-crypto.test.js

@@ -49,6 +49,18 @@ describe('backup-crypto', () => {
     assert.deepStrictEqual(result, sampleConfig);
   });
 
+  it('encrypt rejects empty password', () => {
+    assert.throws(() => encrypt(sampleConfig, ''), /Passwort/);
+    assert.throws(() => encrypt(sampleConfig, null), /Passwort/);
+    assert.throws(() => encrypt(sampleConfig, undefined), /Passwort/);
+  });
+
+  it('decrypt rejects empty password', () => {
+    const buf = encrypt(sampleConfig, 'valid');
+    assert.throws(() => decrypt(buf, ''), /Passwort/);
+    assert.throws(() => decrypt(buf, null), /Passwort/);
+  });
+
   it('each encryption produces different output (random salt/iv)', () => {
     const a = encrypt(sampleConfig, 'same');
     const b = encrypt(sampleConfig, 'same');

tests/config-store.test.js

@@ -131,4 +131,27 @@ describe('ConfigStore', () => {
     assert.equal(config.globalSettings.scaleParallelUploads, false);
     assert.equal(config.globalSettings.logFilePath, '');
   });
+
+  it('concurrent saves preserve both sections', async () => {
+    const save1 = store.save({ hosters: { 'doodstream.com': [{ id: 'c1', enabled: true, authType: 'api', apiKey: 'concurrent-key' }] } });
+    const save2 = store.save({ globalSettings: { alwaysOnTop: true } });
+    await Promise.all([save1, save2]);
+    const config = store.load();
+    assert.equal(config.hosters['doodstream.com'][0].apiKey, 'concurrent-key');
+    assert.equal(config.globalSettings.alwaysOnTop, true);
+  });
+
+  it('backup recovery when main file is corrupted', () => {
+    // Write valid config first
+    fs.writeFileSync(store.filePath, JSON.stringify({
+      hosters: { 'doodstream.com': [{ id: 'bak-1', authType: 'api', apiKey: 'from-backup' }] },
+      hosterSettings: {}, globalSettings: {}, history: []
+    }), 'utf-8');
+    // Copy to backup
+    fs.copyFileSync(store.filePath, store.filePath + '.bak');
+    // Corrupt main file
+    fs.writeFileSync(store.filePath, 'CORRUPTED!!!', 'utf-8');
+    const config = store.load();
+    assert.equal(config.hosters['doodstream.com'][0].apiKey, 'from-backup');
+  });
 });