[rennf93]

make test (the compose test service, pytest -v --cov=.) did not run on a clean clone of master (the uv.lock mount failed), and on 3.14 it had one failing test. It gives 0 failed here. The compose example service starts.

1. uv.lock is gitignored in this repo (git ls-files uv.lock prints nothing), but the Dockerfile ran uv sync --extra dev --frozen and compose.yml bind-mounted ./uv.lock. On a clean clone the build failed with Unable to find lockfile and, once the file was missing, Docker created a directory called uv.lock on the host and the mount failed with not a directory. I copied the guard-core pattern: uv sync --extra dev without --frozen and no uv.lock mount.
2. The Dockerfile copies the package after uv sync, so the project was never installed in the image and nothing put /app on sys.path. I added uv pip install --python .venv/bin/python --no-deps -e /app after the copy, which is what guard-core's Dockerfile does. The compose example runs python examples/simple_app/main.py, which failed with No module named 'tornadoapi_guard' for that reason.
3. tests/test_middleware_unit.py hardcoded redis_url="redis://localhost:6379" in two places and now reads REDIS_URL the way the conftest does. All other tests in this repo already pass an explicit config, so no conftest fixture was needed.
4. Python 3.14 only: test_init_with_blocked_countries_sets_geoip passed a MagicMock as geo_ip_handler. SecurityConfig validates that field against a runtime-checkable protocol (GeoIPHandler), which on 3.12 and later looks attributes up statically and does not accept a bare mock. The test uses a real IPInfoManager.

Verification, the compose test service run as the Makefile runs it, own compose project, Redis without a host port, master vs this branch:

• Python 3.10: master 91 passed, 0 failed (locally generated uv.lock); branch 91 passed, 0 failed.
• Python 3.14: master 90 passed, 1 failed; branch 91 passed, 0 failed.
• The example service from compose.yml: healthy, GET / 200, uid=10001.
• hadolint 2.15.1 on the Dockerfile: no output.

Not verified: Python versions other than 3.10 and 3.14, and the CI result (see the checks on this PR).