fix(security): W4-E1 approvals admin-session only, shared redact table, TMDB key redaction, prod mock gate

- POST /approvals and PATCH /approvals/{id} require a console admin session
  (EndpointDef auth:"session"); API keys incl. admin scope get 403, so an
  organize.execute key can no longer approve its own plan (S1)
- tests for single-use approval checks: expired, revision/payload hash
  mismatch, consumed, revoked, pending/rejected, plan mismatch; re-approve
  after plan change succeeds once and cannot be replayed (S4)
- one redact key table in @umt/contracts shared by server logger and agent
  redactForModel: rsskey, torrent_pass, authkey, downhash, c_secure_pass,
  passkey variants, x-api-key, cookie headers, nested objects/arrays (S2)
- TMDB network errors: message and cause redacted via redactUrl (S3)
- web Agent ?mock=1 only in DEV builds or when pi.provider is fake (S7)
- EndpointDef auth annotations for /auth/*, asserted against
  PUBLIC_AUTH_PATHS (S10); doc drift fixes (S11)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/api-registry.test.ts

@@ -1,6 +1,7 @@
 import { API_PREFIX, listEndpoints } from "@umt/contracts";
 import { describe, expect, it } from "vitest";
 import { createApp } from "../src/http/app.ts";
+import { PUBLIC_AUTH_PATHS } from "../src/http/auth.ts";
 import { EventBus } from "../src/http/sse.ts";
 import { SERVER_MODULES } from "../src/modules/index.ts";
 import type { ServerContext } from "../src/modules/types.ts";
@@ -41,3 +42,50 @@ describe("Api 注册表覆盖", () => {
     expect(unimplemented, `以下端点登记在 api.ts 但未实现:\n${unimplemented.join("\n")}`).toEqual([]);
   });
 });
+
+// 验收 S10:注册表的鉴权标注与服务端实际行为一致(生成 scope 文档不误导集成方)
+describe("Api 注册表鉴权标注", () => {
+  it("auth:'public' 的端点恰好是 PUBLIC_AUTH_PATHS", () => {
+    const pub = listEndpoints()
+      .filter((e) => e.auth === "public")
+      .map((e) => e.path)
+      .sort();
+    expect(pub).toEqual([...PUBLIC_AUTH_PATHS].sort());
+  });
+
+  it("只接受控制台会话的端点都标 auth:'session' 且 scope 为 admin", () => {
+    const session = listEndpoints()
+      .filter((e) => e.auth === "session")
+      .map((e) => `${e.method.toUpperCase()} ${e.path}`)
+      .sort();
+    expect(session).toEqual([
+      "GET /auth/totp",
+      "PATCH /approvals/{id}",
+      "POST /approvals",
+      "POST /auth/password",
+      "POST /auth/totp",
+    ]);
+    for (const e of listEndpoints().filter((x) => x.auth === "session")) expect(e.scope).toBe("admin");
+  });
+
+  it("auth:'session' 的端点拒绝 Bearer(DEV_ADMIN_KEY 也不行)", async () => {
+    const app = createApp({
+      config: { NODE_ENV: "development", DEV_ADMIN_KEY: DEV_KEY },
+      logger: memoryLogger().logger,
+      bus: new EventBus(5),
+      role: "all",
+      version: "0.0.0-test",
+      modules: SERVER_MODULES,
+      ctx: { role: "all" } as unknown as ServerContext,
+    });
+    for (const e of listEndpoints().filter((x) => x.auth === "session")) {
+      const path = e.path.replace("{id}", "00000000-0000-4000-8000-000000000000");
+      const res = await app.request(`${API_PREFIX}${path}`, {
+        method: e.method.toUpperCase(),
+        headers: { authorization: `Bearer ${DEV_KEY}`, "content-type": "application/json" },
+        ...(e.method === "get" ? {} : { body: "{}" }),
+      });
+      expect(res.status, `${e.method} ${e.path}`).toBe(403);
+    }
+  });
+});