fix(security): W4-E1 approvals admin-session only, shared redact table, TMDB key redaction, prod mock gate

- POST /approvals and PATCH /approvals/{id} require a console admin session
  (EndpointDef auth:"session"); API keys incl. admin scope get 403, so an
  organize.execute key can no longer approve its own plan (S1)
- tests for single-use approval checks: expired, revision/payload hash
  mismatch, consumed, revoked, pending/rejected, plan mismatch; re-approve
  after plan change succeeds once and cannot be replayed (S4)
- one redact key table in @umt/contracts shared by server logger and agent
  redactForModel: rsskey, torrent_pass, authkey, downhash, c_secure_pass,
  passkey variants, x-api-key, cookie headers, nested objects/arrays (S2)
- TMDB network errors: message and cause redacted via redactUrl (S3)
- web Agent ?mock=1 only in DEV builds or when pi.provider is fake (S7)
- EndpointDef auth annotations for /auth/*, asserted against
  PUBLIC_AUTH_PATHS (S10); doc drift fixes (S11)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/auth-settings/harness.ts

@@ -10,7 +10,7 @@ import { EventBus } from "../../src/http/sse.ts";
 import { createCapabilityRegistry } from "../../src/modules/agent/capability-registry.ts";
 import { createAuthSettingsModule } from "../../src/modules/auth-settings/index.ts";
 import { createSecretStore, createSettingsReader } from "../../src/modules/auth-settings/provided.ts";
-import type { ServerContext } from "../../src/modules/types.ts";
+import type { ServerContext, ServerModule } from "../../src/modules/types.ts";
 import { DEV_KEY, memoryLogger } from "../helpers.ts";
 
 // 真实 PG 的 W2-A 测试夹具:独立业务 schema + 独立引擎 schema;任务引擎用假对象(只测 cancel 透传)。
@@ -64,7 +64,7 @@ async function adminQuery(q: string) {
   }
 }
 
-export async function createHarness(opts: { engine?: boolean } = {}) {
+export async function createHarness(opts: { engine?: boolean; extraModules?: ServerModule[] } = {}) {
   const uniq = `${process.pid.toString(36)}${Math.random().toString(36).slice(2, 7)}`;
   const schema = `w2a_test_${uniq}`;
   const engineSchema = `${schema}_ow`;
@@ -100,7 +100,16 @@ export async function createHarness(opts: { engine?: boolean } = {}) {
     capabilities: createCapabilityRegistry({ logger }),
   } as ServerContext;
   const mod = createAuthSettingsModule({ setupTokenOnStart: false, engineSchema });
-  const app = createApp({ config, logger, bus, db, role: "all", version: "0.0.0-test", modules: [mod], ctx });
+  const app = createApp({
+    config,
+    logger,
+    bus,
+    db,
+    role: "all",
+    version: "0.0.0-test",
+    modules: [mod, ...(opts.extraModules ?? [])],
+    ctx,
+  });
   return {
     db,
     app,