[rennf93]

make test (the compose test service, pytest -v --cov=.) did not run on master: on a clean clone the uv.lock mount failed, and with a lock in place pytest failed at collection with ImportError: No module named 'tests'. It runs and gives 0 failed here. The compose example service starts.

1. uv.lock is gitignored in this repo (git ls-files uv.lock prints nothing), but the Dockerfile ran uv sync --extra dev --frozen and compose.yml bind-mounted ./uv.lock. On a clean clone the build failed with Unable to find lockfile and, once the file was missing, Docker created a directory called uv.lock on the host and the mount failed with not a directory. I copied the guard-core pattern: uv sync --extra dev without --frozen and no uv.lock mount.
2. The Dockerfile copies the package after uv sync, so the project was never installed in the image and nothing put /app on sys.path. I added uv pip install --python .venv/bin/python --no-deps -e /app after the copy, which is what guard-core's Dockerfile does. That also fixes the collection error: tests.settings is importable when pytest-django loads the settings, so I did not need a python -m workaround.
3. The engine's SecurityConfig defaults to enable_redis=True and redis_url=redis://localhost:6379. Tests that build a config without a redis_url therefore connect to localhost:6379 inside the test container, where no Redis listens, and the middleware answers 503. Tests that hardcoded the URL now read REDIS_URL the way the conftest does, and a session fixture in tests/conftest.py points the engine default at REDIS_URL when it is set (it does nothing when REDIS_URL is unset, so the CI service container on localhost still works). Files: tests/test_middleware.py, tests/conftest.py.
4. The compose example service ran gunicorn, which is not installed in the image. I added gunicorn to the dev extra (and to the deptry DEP002 ignore list next to the other dev tools). The command is gunicorn --chdir examples/simple example_project.wsgi:application ... with DJANGO_SETTINGS_MODULE=example_project.settings, the way examples/simple/compose.yml runs it, because the example's settings import example_project.urls.
5. Python 3.14 only: test_honeypot_form_detection and test_honeypot_json_detection built the request as a MagicMock. The engine checks the request against a runtime-checkable protocol (_BoundedBodyReader), which on 3.12 and later looks attributes up statically and does not see lazily created mock attributes. The tests now assign read_body_prefix as a real attribute.

Verification, the compose test service run as the Makefile runs it, own compose project, Redis without a host port, master vs this branch:

• Python 3.10: master collection error (No module named 'tests'), no test ran; branch 285 passed, 0 failed.
• Python 3.14: master collection error; branch 285 passed, 0 failed.
• Master runs used a locally generated uv.lock (a clean clone fails earlier, at the mount).
• The example service from compose.yml: healthy, GET / 200, uid=10001.
• hadolint 2.15.1 on the Dockerfile: no output.

Not verified: Python versions other than 3.10 and 3.14, and the CI result (see the checks on this PR).