Warn that an api key supersedes the OTA password

tests/component_tests/ota/test_esphome_ota.py

@@ -346,6 +346,44 @@ def test_encryption_with_captive_portal_web_server_ota_warns(
         fv.full_config.reset(token)
 
 
+def test_password_with_api_key_warns(caplog: pytest.LogCaptureFixture) -> None:
+    """An api key makes the device offer encryption, which authenticates an
+    uploader without the password; the config validates with a warning."""
+    full_conf = {
+        CONF_API: {CONF_ENCRYPTION: {CONF_KEY: API_KEY}},
+        CONF_OTA: [_make_ota_config(port=3232, **{CONF_PASSWORD: "pw"})],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert any("only guards plaintext" in r.message for r in caplog.records)
+    finally:
+        fv.full_config.reset(token)
+
+
+@pytest.mark.parametrize(
+    "api_conf",
+    [{}, {CONF_ENCRYPTION: {}}, {CONF_ENCRYPTION: {CONF_KEY: ZEROS_KEY}}],
+    ids=["no_api", "runtime_key", "zeros_key"],
+)
+def test_password_without_static_api_key_no_warning(
+    caplog: pytest.LogCaptureFixture, api_conf: dict[str, Any]
+) -> None:
+    """Without a build-time api key there is no offer, so nothing to warn about."""
+    full_conf = {
+        CONF_API: api_conf,
+        CONF_OTA: [_make_ota_config(port=3232, **{CONF_PASSWORD: "pw"})],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert not any("only guards plaintext" in r.message for r in caplog.records)
+    finally:
+        fv.full_config.reset(token)
+
+
 def test_web_server_ota_without_encryption_unaffected() -> None:
     """web_server ota stays valid alongside an unencrypted esphome entry."""
     full_conf = {