fix: resolve pre-existing test failures uncovered by Pint fix

- Enable Attr.EnableID in HTMLPurifier so id attributes are preserved
- Move URI config before maybeGetRawHTMLDefinition() (config finalization)
- Reorder status attribute checks: circuit broken before disabled
- Use make() for signature tests needing null secrets (bypass auto-gen)
- Register webhook route stub in test setUp for URL generation test
- Use Mockery mock for CdnPurgeService stub to satisfy type hint

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Models/ContentWebhookEndpoint.php

@@ -377,14 +377,14 @@ class ContentWebhookEndpoint extends Model
      */
     public function getStatusColorAttribute(): string
     {
-        if (! $this->is_enabled) {
-            return 'zinc';
-        }
-
         if ($this->isCircuitBroken()) {
             return 'red';
         }
 
+        if (! $this->is_enabled) {
+            return 'zinc';
+        }
+
         if ($this->failure_count > 0) {
             return 'yellow';
         }
@@ -397,14 +397,14 @@ class ContentWebhookEndpoint extends Model
      */
     public function getStatusLabelAttribute(): string
     {
-        if (! $this->is_enabled) {
-            return 'Disabled';
-        }
-
         if ($this->isCircuitBroken()) {
             return 'Circuit Open';
         }
 
+        if (! $this->is_enabled) {
+            return 'Disabled';
+        }
+
         if ($this->failure_count > 0) {
             return "Active ({$this->failure_count} failures)";
         }

Services/HtmlSanitiser.php

@@ -97,6 +97,9 @@ class HtmlSanitiser
         $config->set('HTML.Nofollow', true);
         $config->set('HTML.TargetNoopener', true);
 
+        // Allow id attributes (disabled by default in HTMLPurifier)
+        $config->set('Attr.EnableID', true);
+
         // Safe URI schemes only
         $config->set('URI.AllowedSchemes', [
             'http' => true,

tests/Unit/ContentWebhookEndpointTest.php

@@ -10,6 +10,18 @@ use Tests\TestCase;
 
 class ContentWebhookEndpointTest extends TestCase
 {
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // Register the webhook route if not already defined (routes may not
+        // load in Orchestra Testbench without the full Core event pipeline)
+        if (! \Illuminate\Support\Facades\Route::has('api.content.webhooks.receive')) {
+            \Illuminate\Support\Facades\Route::get('/api/content/webhooks/{endpoint}', fn () => null)
+                ->name('api.content.webhooks.receive');
+        }
+    }
+
     #[Test]
     public function it_generates_uuid_on_creation(): void
     {
@@ -73,7 +85,8 @@ class ContentWebhookEndpointTest extends TestCase
     #[Test]
     public function it_rejects_webhook_without_secret_when_signature_required(): void
     {
-        $endpoint = ContentWebhookEndpoint::factory()->create([
+        // Use make() to bypass the creating event which auto-generates secrets
+        $endpoint = ContentWebhookEndpoint::factory()->make([
             'secret' => null,
             'require_signature' => true,
         ]);
@@ -88,7 +101,8 @@ class ContentWebhookEndpointTest extends TestCase
     #[Test]
     public function it_allows_webhook_without_secret_when_signature_not_required(): void
     {
-        $endpoint = ContentWebhookEndpoint::factory()->create([
+        // Use make() to bypass the creating event which auto-generates secrets
+        $endpoint = ContentWebhookEndpoint::factory()->make([
             'secret' => null,
             'require_signature' => false,
         ]);