fix: apply asset policy to audio beds

[Brad-Edwards]

Summary

Applies the configured asset URL policy to composition audio-bed sources in validation and runtime playback, so hardened deployments can use the same base URL and scheme allowlist for scene assets and composition beds.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #148

ADR Impact

• ADR-004
• ADR-012
• ADR-021

Changes

• Promote the asset URL policy shape into a shared AssetUrlPolicy contract used by validation, preloading, and audio checks.
• Validate composition audioBed.src entries through resolveAssetUrl() with the configured baseUrl and allowedSchemes.
• Thread the asset policy into createAudioService() and the scene loader so bed playback is rejected at runtime if validation was skipped.
• Add string and array audioBed.src tests for validation and runtime policy enforcement, plus default permissive-policy coverage.

Test Plan

• Unit tests pass (make test)

• Integration tests pass if applicable (make integration)

• make check passes (Spotless, SpotBugs, Error Prone, Checkstyle, JaCoCo)

• No coverage regression

• pnpm test -- tests/runtime/validation.test.ts tests/runtime/audio.test.ts tests/runtime/scene-loader-audio.test.ts

• pnpm test -- tests/runtime/audio.test.ts tests/runtime/validation.test.ts tests/runtime/scene-loader-audio.test.ts

• pnpm lint && pnpm typecheck && pnpm test

• pre-commit run --all-files

Ground Control Checks

• make policy passes
• gc_evaluate_quality_gates passes or is unchanged by this repo-only change
• gc_run_sweep reviewed; findings fixed or recorded with rationale

Traceability

• IMPLEMENTS: Issue Harden composition audio-bed URL validation to match production asset policy #148 <- src/runtime/asset-preloader.ts, Issue Harden composition audio-bed URL validation to match production asset policy #148 <- src/runtime/validation.ts, Issue Harden composition audio-bed URL validation to match production asset policy #148 <- src/runtime/audio.ts, Issue Harden composition audio-bed URL validation to match production asset policy #148 <- src/runtime/scene-loader.ts
• TESTS: Issue Harden composition audio-bed URL validation to match production asset policy #148 <- tests/runtime/validation.test.ts, Issue Harden composition audio-bed URL validation to match production asset policy #148 <- tests/runtime/audio.test.ts, Issue Harden composition audio-bed URL validation to match production asset policy #148 <- tests/runtime/scene-loader-audio.test.ts

Checklist

• Code follows project coding standards (docs/CODING_STANDARDS.md)
• No business logic in API layer
• Domain layer has no framework imports
• Envers @Audited on new entities if applicable
• Changelog fragment added at changelog.d/148.fixed.md
• Architectural docs updated if stack, package structure, or key behaviors changed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud