test(service): add golden file validation and master key tests

- Update TESTING.md to reflect current testing status and future plans
- Add golden file comparison for provider snapshot validation in sync_test.go
- Introduce master_test.go for testing Master/Key functionality
- Add testdata directory for contract testing snapshots

internal/service/sync_test.go

@@ -2,6 +2,9 @@ package service
 
 import (
 	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
 	"testing"
 
 	"github.com/alicebob/miniredis/v2"
@@ -10,6 +13,16 @@ import (
 )
 
 func TestSyncProvider_WritesSnapshotAndRouting(t *testing.T) {
+	goldenPath := filepath.Join("testdata", "provider_snapshot.json")
+	goldenRaw, err := os.ReadFile(goldenPath)
+	if err != nil {
+		t.Fatalf("read golden %s: %v", goldenPath, err)
+	}
+	var golden map[string]any
+	if err := json.Unmarshal(goldenRaw, &golden); err != nil {
+		t.Fatalf("parse golden json: %v", err)
+	}
+
 	mr := miniredis.RunT(t)
 	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
 
@@ -40,8 +53,10 @@ func TestSyncProvider_WritesSnapshotAndRouting(t *testing.T) {
 	if err := json.Unmarshal([]byte(raw), &snap); err != nil {
 		t.Fatalf("invalid snapshot json: %v", err)
 	}
-	if snap["google_location"] != "global" {
-		t.Fatalf("expected google_location=global, got %v", snap["google_location"])
+	for k, v := range golden {
+		if !reflect.DeepEqual(snap[k], v) {
+			t.Fatalf("snapshot mismatch for %q: got=%#v want=%#v", k, snap[k], v)
+		}
 	}
 
 	routeKey := "route:group:default:gemini-3-pro-preview"