fix(ariba): a placeholder credential reads as unset, not truthy (#184)

[alexwolson]

Closes #184.

The bug

scrapers/.env.example ships in git with placeholder values so the repo can stay public:

ARIBA_USERNAME=your-ariba-supplier-username
ARIBA_PASSWORD=your-ariba-supplier-password

On a checkout that copied it to scrapers/.env but never filled in real credentials,
load_dotenv() puts those placeholders into the real environment, and os.environ.get(...)
reads them back as non-empty strings. capture_attachments's own "creds unset" guard checks
truthiness (if not (config.ARIBA_USERNAME and config.ARIBA_PASSWORD)), which a placeholder
satisfies — so the guard never fired. login() proceeded and the run died 30 seconds later
inside Playwright:

playwright._impl._errors.TimeoutError: Page.fill: Timeout 30000ms exceeded.
  - fill("your-ariba-supplier-username")

The value is right there in the log, but nothing says "you have no credentials configured." This
cost real time during the #174 session before the cause was spotted.

The fix

config._real_env(name) treats a value equal to the known placeholder as None at load time —
the one place both the existing guard and any future caller check:

_ARIBA_PLACEHOLDER = {"ARIBA_USERNAME": "your-ariba-supplier-username",
                      "ARIBA_PASSWORD": "your-ariba-supplier-password"}

def _real_env(name: str) -> str | None:
    value = os.environ.get(name)
    return None if value == _ARIBA_PLACEHOLDER.get(name) else value

No changes needed to ariba_attachments.py at all — the existing "unset" guard and its message
("Put them in scrapers/.env") already say exactly the right thing once the value is None.

Verification

Against this actual checkout, which still has a leftover placeholder scrapers/.env from an
earlier session:

before: ARIBA_USERNAME = 'your-ariba-supplier-username'   (truthy — guard didn't fire)
after:  ARIBA_USERNAME = None                              (guard fires immediately)

And confirmed capture_attachments now raises in well under a second — no Playwright launch at
all — instead of hanging for 30s:

RuntimeError (fast, no Playwright launch): ARIBA_USERNAME / ARIBA_PASSWORD are unset. Put them
in scrapers/.env (gitignored — the repo is public).

847 tests passing (840 + 7 new): test_config.py covers _real_env in isolation (placeholder
→ None, real credential passes through, genuinely-unset stays None, and that one variable's
placeholder can't accidentally blank the other), plus two tests in test_ariba_attachments.py
confirming capture_attachments fails fast for both a genuinely-missing and a placeholder
credential.

Deliberately not addressed

The issue's "also worth considering" note: login() fills #userid, which Playwright reports
resolving to 2 elements on Ariba's real login page (works today via the legacy non-strict fill()
API, but is "the kind of thing that silently changes"). That's a live browser-automation detail I
have no way to re-verify against Ariba's actual login page in this session, and the issue frames
it as a watch-item, not a required fix — left alone rather than changing selector behavior I can't
test.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W53WHx8mm2UHuLFAQWeF62