docs: define strict dry-run contract

# Conflicts:
#	.secrets.baseline

tests/e2e/test_cli.py

@@ -11,6 +11,23 @@ from pronote_sync.errors import PipelineCriticalError, PipelineWarning
 from pronote_sync.models.pronote import PronoteData
 
 
+def test_help_documents_strict_dry_run_contract(capsys: pytest.CaptureFixture[str]) -> None:
+    """L'aide CLI expose le contrat strict et l'incompatibilité QR/token.
+
+    :param capsys: Capture des sorties standard de pytest.
+    :return: None
+    """
+    from pronote_sync.cli.main import main
+
+    with pytest.raises(SystemExit) as exc_info:
+        main(["--help"])
+
+    output = " ".join(capsys.readouterr().out.split())
+    assert exc_info.value.code == 0
+    assert "sans sortie distante ni état local persistant" in output
+    assert "PRONOTE_AUTH_MODE=qr_token" in output
+
+
 def test_main_runs_composition_root_in_dry_run_with_requested_log_level(
     mocker: MockerFixture,
 ) -> None:

tests/integration/test_pipeline_runner.py

@@ -505,7 +505,6 @@ def test_from_settings_configures_source_state_persistence_for_dry_run(
     import pronote_sync.pipeline.run as run_module
 
     blog_persistence: list[bool] = []
-    auth_persistence: list[bool] = []
 
     class RecordingBlogState:
         """Blog state factory recording its persistence configuration."""
@@ -517,16 +516,6 @@ def test_from_settings_configures_source_state_persistence_for_dry_run(
             """
             blog_persistence.append(persistence_enabled)
 
-    class RecordingAuthState:
-        """Authentication state factory recording its persistence configuration."""
-
-        def __init__(self, *, persistence_enabled: bool = True) -> None:
-            """Record the requested persistence setting.
-
-            :param persistence_enabled: Whether disk writes are enabled.
-            """
-            auth_persistence.append(persistence_enabled)
-
     class RecordingClient:
         """Pronote client constructor accepting the injected auth state."""
 
@@ -539,19 +528,16 @@ def test_from_settings_configures_source_state_persistence_for_dry_run(
             del settings, auth_state
 
     monkeypatch.setattr(run_module, "BlogRSSState", RecordingBlogState)
-    monkeypatch.setattr(run_module, "PronoteAuthState", RecordingAuthState)
     monkeypatch.setattr(run_module, "PronoteClient", RecordingClient)
 
     PipelineRunner.from_settings(
         Settings(
             app=AppSettings(dry_run=dry_run),
             blog=BlogSettings(enabled=True),
-            pronote=PronoteSettings(auth_mode="qr_token"),
         )
     )
 
     assert blog_persistence == [not dry_run]
-    assert auth_persistence == [not dry_run]
 
 
 def test_runner_reuses_ical_download_and_parse_within_one_run(