fix(config): startup log lists the effective features (TOKENS on by default)

The "Authentik QBit produced" line logged the configured feature set, so
TOKENS (on by default whenever writes are enabled) never appeared.
getEffectiveFeatures() reports what hasFeature() says is on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java

@@ -452,6 +452,26 @@ public class AuthentikQBitConfig implements QBitConfig
 
 
 
+   /*******************************************************************************
+    ** The features that are actually on: the configured set, plus TOKENS when it
+    ** is on by default (writes enabled, not opted out), minus TOKENS when it is
+    ** listed but off (read only or opted out). This is what hosts see in logs.
+    *******************************************************************************/
+   public java.util.Set<AuthentikFeature> getEffectiveFeatures()
+   {
+      java.util.EnumSet<AuthentikFeature> effective = java.util.EnumSet.noneOf(AuthentikFeature.class);
+      for(AuthentikFeature feature : AuthentikFeature.values())
+      {
+         if(hasFeature(feature))
+         {
+            effective.add(feature);
+         }
+      }
+      return (effective);
+   }
+
+
+
    /*******************************************************************************
     ** Whether a feature is enabled.
     *******************************************************************************/

src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java

@@ -192,7 +192,7 @@ public class AuthentikQBitProducer implements QBitMetaDataProducer<AuthentikQBit
       }
 
       LOG.info("Authentik QBit produced", logPair("version", VERSION), logPair("appKey", qBitConfig.getAppKey()),
-         logPair("features", qBitConfig.getFeatures()), logPair("readOnly", qBitConfig.getReadOnly()));
+         logPair("features", qBitConfig.getEffectiveFeatures()), logPair("readOnly", qBitConfig.getReadOnly()));
       return (new MetaDataProducerMultiOutput());
    }
 

src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java

@@ -236,4 +236,17 @@ class AuthentikQBitConfigTest
       assertThat(config.getTokenBrokerClientSecret()).isNull();
    }
 
+
+
+   /*******************************************************************************
+    ** The startup log lists TOKENS when it is on by default (writes enabled).
+    *******************************************************************************/
+   @org.junit.jupiter.api.Test
+   void effectiveFeaturesIncludeDefaultTokens()
+   {
+      AuthentikQBitConfig writes = new AuthentikQBitConfig().withFeatures(java.util.EnumSet.of(AuthentikFeature.READ, AuthentikFeature.USERS)).withTokensEnabled(true);
+      org.assertj.core.api.Assertions.assertThat(writes.getEffectiveFeatures()).contains(AuthentikFeature.TOKENS, AuthentikFeature.READ, AuthentikFeature.USERS);
+      AuthentikQBitConfig readOnly = new AuthentikQBitConfig().withFeatures(java.util.EnumSet.of(AuthentikFeature.READ));
+      org.assertj.core.api.Assertions.assertThat(readOnly.getEffectiveFeatures()).containsExactly(AuthentikFeature.READ);
+   }
 }