fix(security): W4-E1 approvals admin-session only, shared redact table, TMDB key redaction, prod mock gate

- POST /approvals and PATCH /approvals/{id} require a console admin session
  (EndpointDef auth:"session"); API keys incl. admin scope get 403, so an
  organize.execute key can no longer approve its own plan (S1)
- tests for single-use approval checks: expired, revision/payload hash
  mismatch, consumed, revoked, pending/rejected, plan mismatch; re-approve
  after plan change succeeds once and cannot be replayed (S4)
- one redact key table in @umt/contracts shared by server logger and agent
  redactForModel: rsskey, torrent_pass, authkey, downhash, c_secure_pass,
  passkey variants, x-api-key, cookie headers, nested objects/arrays (S2)
- TMDB network errors: message and cause redacted via redactUrl (S3)
- web Agent ?mock=1 only in DEV builds or when pi.provider is fake (S7)
- EndpointDef auth annotations for /auth/*, asserted against
  PUBLIC_AUTH_PATHS (S10); doc drift fixes (S11)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/agent/http.ts

@@ -2,7 +2,7 @@ import { createRoute, type RouteConfig } from "@hono/zod-openapi";
 import { type Actor, type ApiScope, apiResponse, type EndpointDef } from "@umt/contracts";
 import type { Context } from "hono";
 import type { z } from "zod";
-import { type AuthEnv, requireScope } from "../../http/auth.ts";
+import { type AuthEnv, requireAdminSession, requireScope } from "../../http/auth.ts";
 import type { ModuleApp } from "../types.ts";
 
 // 本模块路由封装:吃 contracts 的 EndpointDef(Api.xxx),createRoute 进 OpenAPI + requireScope + 入参校验,
@@ -44,7 +44,11 @@ export function route<D extends EndpointDef>(
     path: def.path,
     summary: def.summary,
     tags: [opts.tag ?? "agent"],
-    middleware: [requireScope(def.scope as ApiScope)] as never,
+    // auth: "session" 的端点(审批申请/决定)在 scope 之外再要求控制台管理员会话,API Key 一律 403
+    middleware: [
+      requireScope(def.scope as ApiScope),
+      ...(def.auth === "session" ? [requireAdminSession()] : []),
+    ] as never,
     request,
     responses: {
       [status]: { description: def.summary, content: { "application/json": { schema: apiResponse(def.response) } } },

apps/server/src/modules/agent/routes.ts

@@ -290,7 +290,7 @@ export function registerAgentRoutes(
     },
     { status: 201 },
   );
-  route(app, Api.approvals.update!, async ({ params, body, actorId }) => {
+  route(app, Api.approvals.update, async ({ params, body, actorId }) => {
     const r = await db()
       .transaction()
       .execute(async (trx) => {