fix: warn when TLS verification is disabled

REDMINE_VERIFY=false / verify_ssl: false silently disabled TLS
certificate verification, exposing the connection to MITM attacks.
Config.validate() now prints a warning to stderr when verification
is disabled (exactly False; True or a CA-bundle path stays quiet).
validate() runs exactly once at CLI startup, so the warning is
emitted once per run and is visible in every scenario.

Closes #57

tests/test_config.py

@@ -176,6 +176,46 @@ class TestConfigRequiresHttpsUrl:
         Config.validate()
 
 
+# -- #57: предупреждение при отключённой проверке TLS --
+
+
+class TestWarnWhenTlsVerificationDisabled:
+    """verify_ssl: false должен давать видимый warning в stderr (риск MITM)."""
+
+    _ENV = {"REDMINE_URL": "https://red.eltex.loc/", "REDMINE_API_KEY": "token"}
+
+    def _validate_env(self, verify: str):
+        return {**self._ENV, "REDMINE_VERIFY": verify}
+
+    def test_verify_false_warns_in_stderr(self, capsys):
+        with mock.patch.dict(os.environ, self._validate_env("false"), clear=True):
+            Config.validate()
+
+        err = capsys.readouterr().err
+        assert "⚠️" in err
+        assert "TLS" in err or "SSL" in err
+
+    def test_verify_true_no_warning(self, capsys):
+        with mock.patch.dict(os.environ, self._validate_env("true"), clear=True):
+            Config.validate()
+
+        assert capsys.readouterr().err == ""
+
+    def test_verify_ca_path_no_warning(self, capsys):
+        with mock.patch.dict(
+            os.environ, self._validate_env("/tmp/redmine-ca.pem"), clear=True
+        ):
+            Config.validate()
+
+        assert capsys.readouterr().err == ""
+
+    def test_verify_default_no_warning(self, capsys):
+        with mock.patch.dict(os.environ, self._ENV, clear=True):
+            Config.validate()
+
+        assert capsys.readouterr().err == ""
+
+
 # -- #15: .env не должен переопределять переменные окружения --