Separate Best Practice rules definition into dedicated best_practice_rules module

tests/test_server_roles_and_best_practices.py

@@ -20,6 +20,7 @@ from src.common.system_info import (
     get_installed_windows_server_roles
 )
 from src.hub.best_practices import BestPracticeEngine, BestPracticeRule, BEST_PRACTICES_ENGINE
+from src.hub.best_practice_rules import BASELINE_RULES, get_baseline_rules
 from src.hub.web_ui import WebUIRenderer
 from src.hub.Server import app, SERVER_STATE, DEFAULT_DB_FILE
 from src.hub.auth_manager import SessionManager
@@ -119,6 +120,28 @@ class TestServerRolesAndBestPractices(unittest.TestCase):
         eval_fail = engine.evaluate_node({"hostname": "server1.public.com"})
         self.assertTrue(any(r["rule_id"] == "BP-CUSTOM-001" and r["status"] == "FAIL" for r in eval_fail))
 
+    def test_rules_defined_in_separate_file(self):
+        """Verifies Best Practice rules are defined in separate best_practice_rules module."""
+        rules = get_baseline_rules()
+        self.assertGreaterEqual(len(rules), 5)
+        for r in rules:
+            self.assertIsInstance(r, BestPracticeRule)
+            self.assertTrue(r.rule_id.startswith("BP-"))
+            self.assertTrue(r.title)
+            self.assertTrue(r.description)
+            self.assertTrue(r.recommendation)
+            self.assertIn(r.severity, ["CRITICAL", "WARNING", "RECOMMENDED"])
+            self.assertIsNotNone(r.eval_fn)
+
+        # Engine automatically registers all rules from best_practice_rules module
+        engine = BestPracticeEngine()
+        loaded_ids = [r["rule_id"] for r in engine.get_rules()]
+        self.assertIn("BP-SYS-001", loaded_ids)
+        self.assertIn("BP-SYS-002", loaded_ids)
+        self.assertIn("BP-AD-001", loaded_ids)
+        self.assertIn("BP-WIN-002", loaded_ids)
+        self.assertIn("BP-SEC-003", loaded_ids)
+
     def test_client_info_html_rendering(self):
         """Verifies GET /client-info redirects to /login when unauthenticated, and renders HTML when authenticated."""
         # Unauthenticated redirects to /login