test(server): cover validation 422s and pick-None 404; tighten message assert

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_api.py

@@ -29,7 +29,7 @@ def test_fetch_returns_job_and_message(client, auth, monkeypatch):
     assert r.status_code == 200
     body = r.json()
     assert body["status"] == "queued"
-    assert "Under My Skin" in body["message"] or "Together" in body["message"]
+    assert "Together" in body["message"]
     assert body["hit"]["artist"] == "Avril Lavigne"
     assert body["job_id"]
 
@@ -79,3 +79,26 @@ def test_unknown_job_404(client, auth):
 def test_jobs_requires_key(client):
     r = client.get("/jobs/whatever")
     assert r.status_code == 401
+
+
+def test_fetch_invalid_quality_422(client, auth):
+    r = client.post("/fetch", params={"q": "x", "quality": "bogus"}, headers=auth)
+    assert r.status_code == 422
+    assert "message" in r.json()
+
+
+def test_fetch_invalid_source_422(client, auth):
+    r = client.post("/fetch", params={"q": "x", "source": "spotify"}, headers=auth)
+    assert r.status_code == 422
+    assert "message" in r.json()
+
+
+def test_fetch_pick_none_returns_404(client, auth, monkeypatch):
+    hit = _yt_hit()
+    monkeypatch.setattr("server.app.mf.build_combined_hits",
+                        lambda q, limit, yt_first, lidarr_only, yt_only: [hit])
+    monkeypatch.setattr("server.app.mf.pick",
+                        lambda hits, q, noninteractive, yt_first: None)
+    r = client.post("/fetch", params={"q": "x"}, headers=auth)
+    assert r.status_code == 404
+    assert "message" in r.json()