M8-R07: integrate WarmteLink device access into Compose

tests/test_deployment.py

@@ -72,35 +72,36 @@ def test_compose_uses_migration_job_before_app() -> None:
     assert dev["services"]["app"]["build"] == "."
 
 
-def test_warmtelink_overlay_keeps_app_non_root_and_maps_minimal_serial_device_access() -> None:
-    """The optional overlay grants only pyserial's minimal open permission.
+def test_compose_keeps_app_non_root_and_maps_minimal_warmtelink_serial_access() -> None:
+    """Base Compose maps the configured device with only pyserial's required access.
 
     Environment interpolation is deliberately left unresolved: operators supply
-    a host-specific stable by-id path and its numeric serial GID at deployment.
+    a host-specific stable by-id path and its numeric serial GID in local .env.
+    The dev compose file inherits this app configuration unchanged.
     """
     base = _read_yaml("docker-compose.yml")
-    overlay = _read_yaml("docker-compose.warmtelink.yml")
+    dev = _read_yaml("docker-compose.dev.yml")
 
     base_app = base["services"]["app"]
     base_migration = base["services"]["migration"]
-    app_overlay = overlay["services"]["app"]
     assert base_app["user"] == "1000:1000"
     assert base_migration["user"] == "1000:1000"
     assert "privileged" not in base_app
     assert "privileged" not in base_migration
-    assert "user" not in app_overlay
-    assert "privileged" not in app_overlay
-    assert app_overlay["devices"] == [
+    assert "cap_add" not in base_app
+    assert "cap_add" not in base_migration
+    assert base_app["devices"] == [
         "${WARMTELINK_DEVICE_PATH:?Set a stable /dev/serial/by-id path}:/dev/warmtelink:rw"
     ]
-    device_rule = app_overlay["devices"][0]
+    device_rule = base_app["devices"][0]
     permissions = device_rule.rsplit(":", maxsplit=1)[1]
     assert permissions == "rw"
     assert "m" not in permissions
-    assert app_overlay["group_add"] == ["${WARMTELINK_SERIAL_GID:?Set the host serial device GID}"]
-    assert "/dev/serial/by-id" in (PROJECT_ROOT / "docker-compose.warmtelink.yml").read_text()
-    assert "migration" not in overlay["services"]
+    assert base_app["group_add"] == ["${WARMTELINK_SERIAL_GID:?Set the host serial device GID}"]
+    assert dev["services"]["app"]["devices"] == base_app["devices"]
+    assert dev["services"]["app"]["group_add"] == base_app["group_add"]
     assert "devices" not in base_migration
+    assert "group_add" not in base_migration
     assert "privileged" not in base_migration