fix(settings): tighten coerce/normalize per code review

- reject non-integer floats in int coerce path
- document masking responsibility on to_public_dict
- use tuple for enum_values (immutable)
- treat empty string as None in normalize_for_compare

web/mcp_env_catalog.py

@@ -26,11 +26,11 @@ class EnvSpec:
     default: Any = None
     min: float | None = None
     max: float | None = None
-    enum_values: list[str] | None = None
+    enum_values: tuple[str, ...] | None = None
 
     def to_public_dict(self) -> dict[str, Any]:
-        d = asdict(self)
-        return d
+        """Return spec fields as a dict. Does NOT mask secret values — caller must handle."""
+        return asdict(self)
 
 
 ENV_CATALOG: dict[str, EnvSpec] = {
@@ -162,6 +162,8 @@ def coerce(spec: EnvSpec, raw: Any) -> Any:
             return False
         raise ValueError(f"ערך bool לא חוקי: {raw}")
     if spec.type == "int":
+        if isinstance(raw, float) and not raw.is_integer():
+            raise ValueError(f"ערך int לא חוקי (שבר עשרוני): {raw}")
         try:
             v = int(raw)
         except (TypeError, ValueError):
@@ -190,7 +192,7 @@ def coerce(spec: EnvSpec, raw: Any) -> Any:
 
 def normalize_for_compare(spec: EnvSpec, raw: str | None) -> str | None:
     """Normalize a raw env string to a canonical form for drift comparison."""
-    if raw is None:
+    if not raw:  # None or ""
         return None
     try:
         v = coerce(spec, raw)