## Implementation Plan

### Problem
The `gateway_system_preamble` runtime configuration can be set to a "void-world" prompt that instructs the LLM that "everything is allowed" with no rules or consequences. This preamble is injected into all gateway requests, corrupting production tasks like news grading, SEO metadata, issue enhancement, and news reformatting. The source code correctly defaults to `""`, but no defense prevents a harmful preamble from being set via the admin UI or database.

### Goal
Add a safety check in the preamble injection logic to detect and reject preambles containing the void-world pattern (or any pattern that explicitly denies rules/consequences), effectively making any such setting harmless. This prevents recurrence even if the configuration is later changed.

### Changes Required

**File 1: `devplacepy/services/openai_gateway/system_message.py`**

1. Add a constant tuple of prohibited substrings (case-insensitive) that should cause the preamble to be ignored:
   ```python
   PREAMBLE_PROHIBITED_PATTERNS = (
       "sole consciousness",
       "void-world",
       "void world",
       "absolute void",
       "everything is allowed",
       "no consequences",
       "no rules",
   )
   ```

2. Modify the `apply_system_directives` function: after retrieving `preamble_text`, check if it contains any prohibited pattern (lowercased). If so:
   - Log a warning via `logging.warning` (import `logging` if not already).
   - Set `preamble_text = ""` so that no preamble is injected/merged.
   - (The existing empty-preamble guard at line 99 will then make the function a no-op or fall through to the date-only injection.)

   Specifically, after line 98 (`preamble_text = preamble_text.strip()` or the assignment), add:
   ```python
   if preamble_text:
       _clean = preamble_text.lower()
       if any(p in _clean for p in PREAMBLE_PROHIBITED_PATTERNS):
           logging.warning("Gateway system preamble contains prohibited content; ignoring.")
           preamble_text = ""
   ```

**File 2: `tests/unit/services/openai_gateway/system_message_test.py`** (new file)

3. Create a test file for `apply_system_directives` with at least these test cases:
   - Empty preamble → no system message injected.
   - Empty preamble, existing system message → date is appended.
   - Normal preamble (e.g., "You are a helpful assistant") → injected into request without system message.
   - Normal preamble, existing system message → merged (preamble + date appended).
   - Void-world preamble → treated as empty preamble (no injection, no merge).
   - Void-world preamble, existing system message → only date appended (preamble ignored).

   Use `pytest` as the rest of the project.

**File 3: `devplacepy/services/openai_gateway/gateway_test.py`** (optional, but prefer to extend existing test)

If the existing `tests/unit/services/openai_gateway/gateway.py` test file is present, add one test that verifies the gateway request with a prohibited preamble results in no system message (or only the date) in the final messages. However, to keep scope minimal, focus on the unit test for `apply_system_directives`.

### Definition of Done

- [ ] The constant `PREAMBLE_PROHIBITED_PATTERNS` is defined in `system_message.py`.
- [ ] `apply_system_directives` imports `logging` and uses `logging.warning` when a prohibited preamble is detected.
- [ ] When a preamble contains any prohibited pattern, it is replaced with `""` and the injection logic proceeds as if the preamble were empty.
- [ ] No other code paths are affected; normal preambles still function.
- [ ] A new test file `tests/unit/services/openai_gateway/system_message_test.py` exists with test coverage for all cases listed above.
- [ ] All existing unit tests pass:
  ```
  pip install -e '.[dev]' -q && make test-unit
  ```
- [ ] Linter passes:
  ```
  pip install -q ruff && ruff check .
  ```
- [ ] No syntax errors in any modified or new files.