refactor: read settings directly instead of getattr with a second default

About 85 call sites read a setting as getattr(settings, "NAME", fallback),
each carrying its own copy of the default. Every one of those names is a
field with a default on the model, so the fallback could never apply to
the real settings object; it only masked drift. Two had drifted:

- OPENAI_PROMPT_CACHE_KEY defaults to True on the model but the reader
  fell back to False, and two test stubs relied on that.
- SharePoint's MICROSOFT_AUTHORITY fallback to
  https://login.microsoftonline.com/<tenant> never fired, because the
  attribute always exists (as None), so MSAL got authority=None. The
  connector now derives the tenant authority when the setting is unset,
  as its test always assumed.

Four places read EMBEDDINGS_KEY straight from os.environ, skipping the
"None"/"" normalisation the model applies; they read the setting now.
Test stubs that replaced a module's settings with a SimpleNamespace list
every setting the code under test reads.

docsgpt/agents/tools/artifact_generator.py

@@ -829,7 +829,7 @@ class ArtifactGeneratorTool(Tool):
         spec_path = f"{token_dir}/spec.json"
         out_path = f"{token_dir}/out.{_KIND_INFO[kind]['ext']}"
         program = _RENDERERS[kind].format(spec_path=spec_path, out_path=out_path)
-        timeout = float(getattr(settings, "SANDBOX_EXEC_TIMEOUT", 60))
+        timeout = float(settings.SANDBOX_EXEC_TIMEOUT)
 
         manager = SandboxCreator.get_manager()
         try:

docsgpt/agents/tools/attachment_bridge.py

@@ -113,7 +113,7 @@ def bridge_attachment(
     # Reject oversize attachments BEFORE buffering them: the authoritative ``size``
     # column lets us avoid pulling a multi-hundred-MB file fully into worker memory,
     # and the bounded read below backstops a missing/lying ``size``.
-    max_bytes = int(getattr(settings, "ARTIFACT_MAX_BYTES", 0) or 0)
+    max_bytes = int(settings.ARTIFACT_MAX_BYTES or 0)
     declared_size = attachment.get("size")
     if max_bytes and isinstance(declared_size, (int, float)) and declared_size > max_bytes:
         raise AttachmentBridgeError(

docsgpt/agents/tools/code_executor.py

@@ -87,9 +87,9 @@ class CodeExecutorTool(Tool):
         baked in. Keep the package lists in sync with deployment/sandbox/Dockerfile
         (jupyter) and scripts/build_daytona_snapshot.py (daytona snapshot).
         """
-        backend = str(getattr(settings, "SANDBOX_BACKEND", "jupyter") or "jupyter").lower()
+        backend = str(settings.SANDBOX_BACKEND or "jupyter").lower()
         if backend == "daytona":
-            if getattr(settings, "DAYTONA_SNAPSHOT", None):
+            if settings.DAYTONA_SNAPSHOT:
                 return (
                     "Preinstalled beyond the stdlib: python-pptx, python-docx, openpyxl, "
                     "reportlab, lxml, pillow. pip install anything else from within the code "
@@ -330,7 +330,7 @@ class CodeExecutorTool(Tool):
             # Reject an oversize input BEFORE buffering it: the declared ``size``
             # avoids pulling a huge file into worker memory, and the bounded read
             # below backstops a missing/lying size column.
-            max_bytes = int(getattr(settings, "SANDBOX_MAX_INPUT_BYTES", 0) or 0)
+            max_bytes = int(settings.SANDBOX_MAX_INPUT_BYTES or 0)
             declared_size = version.get("size")
             if max_bytes and isinstance(declared_size, (int, float)) and declared_size > max_bytes:
                 return {"error": f"input artifact {artifact_id} exceeds the {max_bytes}-byte sandbox input limit."}
@@ -484,7 +484,7 @@ class CodeExecutorTool(Tool):
     @staticmethod
     def _exec_timeout() -> float:
         """Return the fixed per-run wall-clock cap (SANDBOX_EXEC_TIMEOUT; not caller-adjustable)."""
-        return float(getattr(settings, "SANDBOX_EXEC_TIMEOUT", 60))
+        return float(settings.SANDBOX_EXEC_TIMEOUT)
 
     @staticmethod
     def _is_timeout(result: ExecResult) -> bool:

docsgpt/agents/tools/mcp_tool.py

@@ -108,11 +108,11 @@ class MCPTool(Tool):
         if configured_redirect_uri:
             return configured_redirect_uri.rstrip("/")
 
-        explicit = getattr(settings, "MCP_OAUTH_REDIRECT_URI", None)
+        explicit = settings.MCP_OAUTH_REDIRECT_URI
         if explicit:
             return explicit.rstrip("/")
 
-        connector_base = getattr(settings, "CONNECTOR_REDIRECT_BASE_URI", None)
+        connector_base = settings.CONNECTOR_REDIRECT_BASE_URI
         if connector_base:
             parsed = urlparse(connector_base)
             if parsed.scheme and parsed.netloc:

docsgpt/agents/tools/read_document.py

@@ -255,7 +255,7 @@ class ReadDocumentTool(Tool):
         # The task's per-call time limits are raised to match the awaited window: bound to
         # the base timeout at import, the worker would otherwise self-terminate a large
         # parse long before this await gives up.
-        queue = getattr(settings, "DOCUMENT_PARSE_QUEUE", "parsing")
+        queue = settings.DOCUMENT_PARSE_QUEUE
         try:
             async_result = parse_document.apply_async(
                 args=[artifact_id, parent, self.user_id, options],