feat(config): pydantic settings loader from .env

Aggiunge Settings (BaseSettings) che carica configurazione da
variabili d'ambiente / file .env, con validazione obbligatoria
dei segreti Cerbero testnet e OpenRouter.

Test:
- test_settings_loads_from_env: happy path via monkeypatch.setenv
- test_settings_requires_tokens: ValidationError quando token
  obbligatori mancano (forza _env_file=None per isolare il test
  da eventuale .env locale popolato).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/test_config.py

@@ -0,0 +1,42 @@
+"""Tests for multi_swarm.config.Settings.
+
+Note on .env isolation:
+The happy-path test relies on monkeypatch.setenv to provide values.
+The "requires tokens" test forces _env_file=None when constructing Settings,
+so that a developer's local .env (if present and populated) cannot mask the
+absence of required env vars. This keeps the test deterministic both in CI
+(no .env) and in local dev (.env may exist).
+"""
+
+import pytest
+
+from multi_swarm.config import Settings
+
+
+def test_settings_loads_from_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("CERBERO_BASE_URL", "http://test:9000")
+    monkeypatch.setenv("CERBERO_TESTNET_TOKEN", "tok-test")
+    monkeypatch.setenv("CERBERO_MAINNET_TOKEN", "tok-main")
+    monkeypatch.setenv("CERBERO_BOT_TAG", "swarm-poc-phase1")
+    monkeypatch.setenv("OPENROUTER_API_KEY", "or-key")
+    monkeypatch.setenv("ANTHROPIC_API_KEY", "an-key")
+    monkeypatch.setenv("RUN_NAME", "test-run")
+
+    s = Settings()  # type: ignore[call-arg]
+
+    assert s.cerbero_base_url == "http://test:9000"
+    assert s.cerbero_testnet_token.get_secret_value() == "tok-test"
+    assert s.run_name == "test-run"
+    assert s.data_dir.name == "data"
+    assert s.db_path.name == "runs.db"
+
+
+def test_settings_requires_tokens(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("CERBERO_TESTNET_TOKEN", raising=False)
+    monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
+    from pydantic import ValidationError
+
+    with pytest.raises(ValidationError):
+        # Disable .env loading to keep the test deterministic regardless of
+        # whether a developer's local .env exists and is populated.
+        Settings(_env_file=None)  # type: ignore[call-arg]