feat(test): add comprehensive external API integration tests with PDF generation

- Add fpdf2 dependency for dynamic test PDF generation
- Create tests/test_external_integrations.py with end-to-end pipeline tests:
  - OpenAI: key validation, metadata extraction via chat completion
  - Azure Document Intelligence: admin connectivity, full OCR on generated PDF
  - S3: bucket access, upload/download/delete pipeline
  - Dropbox: token refresh, upload/download/delete pipeline
  - OneDrive: token refresh, upload/download/delete pipeline
  - Authentik: OIDC discovery endpoint, credential consistency
  - Full pipeline: Azure OCR → OpenAI metadata extraction
- Update tests/conftest.py to capture original env vars before test overrides
- Add has_real_env() helper and original_env fixture for credential detection
- All external tests use @pytest.mark.requires_external and skipif guards
- Test files are dynamically generated with unique content per run
- Uploaded test files are cleaned up in finally blocks

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

tests/conftest.py

@@ -4,7 +4,7 @@ Pytest configuration and shared fixtures for DocuElevate tests.
 
 import os
 import tempfile
-from typing import Generator
+from typing import Dict, Generator, Optional
 
 import pytest
 from fastapi.testclient import TestClient
@@ -12,6 +12,37 @@ from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
 from sqlalchemy.pool import StaticPool
 
+# Capture original environment variables before overriding with test defaults.
+# This allows integration tests to detect when real API credentials are available
+# (e.g., injected via GitHub Actions secrets) and run live API verification.
+_EXTERNAL_API_ENV_KEYS = [
+    "OPENAI_API_KEY",
+    "OPENAI_BASE_URL",
+    "AZURE_AI_KEY",
+    "AZURE_ENDPOINT",
+    "AZURE_REGION",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "S3_BUCKET_NAME",
+    "S3_FOLDER_PREFIX",
+    "DROPBOX_APP_KEY",
+    "DROPBOX_APP_SECRET",
+    "DROPBOX_REFRESH_TOKEN",
+    "ONEDRIVE_CLIENT_ID",
+    "ONEDRIVE_CLIENT_SECRET",
+    "ONEDRIVE_REFRESH_TOKEN",
+    "ONEDRIVE_TENANT_ID",
+    "ONEDRIVE_FOLDER_PATH",
+    "GOOGLE_DRIVE_CREDENTIALS_JSON",
+    "GOOGLE_DRIVE_FOLDER_ID",
+    "AUTHENTIK_CLIENT_ID",
+    "AUTHENTIK_CLIENT_SECRET",
+    "AUTHENTIK_CONFIG_URL",
+    "SESSION_SECRET",
+]
+_PLACEHOLDER_VALUES = {"test-key", "test", "", "NOT_SET"}
+_original_env: Dict[str, Optional[str]] = {key: os.environ.get(key) for key in _EXTERNAL_API_ENV_KEYS}
+
 # Set test environment variables before importing app
 os.environ["DATABASE_URL"] = "sqlite:///:memory:"
 os.environ["REDIS_URL"] = "redis://localhost:6379/1"
@@ -167,6 +198,26 @@ def mock_azure_response():
     return {"analyzeResult": {"content": "Test document content extracted by OCR", "pages": [{"pageNumber": 1}]}}
 
 
+def has_real_env(*keys: str) -> bool:
+    """Check if real (non-placeholder) environment variables were set before test overrides.
+
+    Returns True only if ALL specified keys had non-placeholder values in the
+    original environment.  Used by integration tests to decide whether to skip
+    when real credentials are unavailable.
+    """
+    for key in keys:
+        value = _original_env.get(key)
+        if value is None or value in _PLACEHOLDER_VALUES:
+            return False
+    return True
+
+
+@pytest.fixture(scope="session")
+def original_env() -> Dict[str, Optional[str]]:
+    """Provide access to the original environment variables captured before test overrides."""
+    return dict(_original_env)
+
+
 # Markers for categorizing tests
 def pytest_configure(config):
     """Configure custom pytest markers."""