Fix PCM auth: login for API token and multi webhook secrets.

PCM DirectMail v3 needs POST /auth/login (apiKey+apiSecret) before design/order calls; accept each subscription's copy-only signature secret via PCM_WEBHOOK_SECRETS.

site/messaging/tests.py

@@ -608,7 +608,7 @@ class PcmPostcardWebhookTests(TestCase):
         import json
 
         url = reverse("messaging:postcard_webhook")
-        with self.settings(PCM_WEBHOOK_SECRET="pcm-secret"):
+        with self.settings(PCM_WEBHOOK_SECRET="pcm-secret", PCM_WEBHOOK_SECRETS=""):
             denied = self.client.post(
                 url,
                 data=json.dumps({"status": "Delivered", "orderID": 555}),
@@ -627,3 +627,83 @@ class PcmPostcardWebhookTests(TestCase):
                 HTTP_AUTHORIZATION="Bearer pcm-secret",
             )
             self.assertEqual(ok.status_code, 200)
+
+    def test_accepts_any_secret_from_list(self):
+        import json
+
+        url = reverse("messaging:postcard_webhook")
+        with self.settings(
+            PCM_WEBHOOK_SECRET="",
+            PCM_WEBHOOK_SECRETS="sec-a,sec-b",
+        ):
+            denied = self.client.post(
+                url,
+                data=json.dumps({"status": "Delivered", "orderID": "order-555"}),
+                content_type="application/json",
+                HTTP_AUTHORIZATION="Bearer wrong",
+            )
+            self.assertEqual(denied.status_code, 403)
+            ok = self.client.post(
+                url,
+                data=json.dumps({"status": "Delivered", "orderID": "order-555"}),
+                content_type="application/json",
+                HTTP_AUTHORIZATION="Bearer sec-b",
+            )
+            self.assertEqual(ok.status_code, 200)
+
+
+class PcmAuthTests(TestCase):
+    def setUp(self):
+        from messaging.providers.postcard import pcm as pcm_mod
+
+        pcm_mod.clear_token_cache()
+
+    def tearDown(self):
+        from messaging.providers.postcard import pcm as pcm_mod
+
+        pcm_mod.clear_token_cache()
+
+    def test_login_required_before_design_list(self):
+        from unittest.mock import MagicMock, patch
+
+        from messaging.providers.postcard import pcm as pcm_mod
+
+        login_resp = MagicMock()
+        login_resp.status_code = 200
+        login_resp.content = b'{"token":"session-tok","expires":"2099-01-01T00:00:00.000Z"}'
+        login_resp.json.return_value = {
+            "token": "session-tok",
+            "expires": "2099-01-01T00:00:00.000Z",
+        }
+
+        design_resp = MagicMock()
+        design_resp.status_code = 200
+        design_resp.content = b'{"results":[]}'
+        design_resp.json.return_value = {"results": []}
+
+        with self.settings(PCM_API_KEY="key", PCM_API_SECRET="secret"):
+            with patch("messaging.providers.postcard.pcm.requests.post") as post:
+                with patch(
+                    "messaging.providers.postcard.pcm.requests.request"
+                ) as request:
+                    post.return_value = login_resp
+                    request.return_value = design_resp
+                    designs = pcm_mod.list_designs()
+
+        self.assertEqual(designs, [])
+        post.assert_called_once()
+        self.assertIn("/auth/login", post.call_args.args[0])
+        self.assertEqual(
+            post.call_args.kwargs["json"],
+            {"apiKey": "key", "apiSecret": "secret"},
+        )
+        auth = request.call_args.kwargs["headers"]["Authorization"]
+        self.assertEqual(auth, "Bearer session-tok")
+
+    def test_missing_secret_raises(self):
+        from messaging.providers.postcard import pcm as pcm_mod
+
+        with self.settings(PCM_API_KEY="key", PCM_API_SECRET=""):
+            with self.assertRaises(pcm_mod.PcmApiError) as ctx:
+                pcm_mod.login(force=True)
+        self.assertIn("PCM_API_SECRET", str(ctx.exception))