fix(security): W4-E1 approvals admin-session only, shared redact table, TMDB key redaction, prod mock gate

- POST /approvals and PATCH /approvals/{id} require a console admin session
  (EndpointDef auth:"session"); API keys incl. admin scope get 403, so an
  organize.execute key can no longer approve its own plan (S1)
- tests for single-use approval checks: expired, revision/payload hash
  mismatch, consumed, revoked, pending/rejected, plan mismatch; re-approve
  after plan change succeeds once and cannot be replayed (S4)
- one redact key table in @umt/contracts shared by server logger and agent
  redactForModel: rsskey, torrent_pass, authkey, downhash, c_secure_pass,
  passkey variants, x-api-key, cookie headers, nested objects/arrays (S2)
- TMDB network errors: message and cause redacted via redactUrl (S3)
- web Agent ?mock=1 only in DEV builds or when pi.provider is fake (S7)
- EndpointDef auth annotations for /auth/*, asserted against
  PUBLIC_AUTH_PATHS (S10); doc drift fixes (S11)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/logger.test.ts

@@ -60,3 +60,96 @@ describe("日志脱敏:child 绑定与 Error 序列化", () => {
     expect(redact(new Error("x?token=abc"))).toMatchObject({ type: "Error", message: "x?token=[REDACTED]" });
   });
 });
+
+// 验收 S2:站点常见凭证参数/键名全部覆盖,键表与 Agent redactForModel 同源(@umt/contracts)
+describe("日志脱敏:站点凭证键全集", () => {
+  const PARAMS = [
+    "passkey",
+    "PassKey",
+    "pass_key",
+    "pass-key",
+    "rsskey",
+    "torrent_pass",
+    "authkey",
+    "downhash",
+    "c_secure_pass",
+    "api_key",
+    "apikey",
+    "token",
+  ];
+
+  it.each(PARAMS)("URL query 参数 %s 被遮住", (name) => {
+    const out = redactString(`GET https://pt.example/rss.php?id=7&${name}=SECRETVALUE9&x=1`);
+    expect(out).not.toContain("SECRETVALUE9");
+    expect(out).toContain(`${name}=[REDACTED]`);
+    expect(out).toContain("id=7");
+    expect(out).toContain("x=1");
+  });
+
+  it("验收报告里的实测串一次性全部遮住", () => {
+    const out = redactString("/rss?rsskey=abc1&torrent_pass=dead2&authkey=zz3&downhash=q14&c_secure_pass=cc5");
+    for (const s of ["abc1", "dead2", "zz3", "q14", "cc5"]) expect(out).not.toContain(s);
+  });
+
+  const KEYS = [
+    "passkey",
+    "PassKey",
+    "pass-key",
+    "pass_key",
+    "PASSKEY",
+    "rsskey",
+    "rssKey",
+    "torrent_pass",
+    "torrentPass",
+    "authkey",
+    "authKey",
+    "downhash",
+    "c_secure_pass",
+    "x-api-key",
+    "X-Api-Key",
+    "apiKey",
+    "cookie",
+    "Cookie",
+    "set-cookie",
+    "authorization",
+    "accessToken",
+  ];
+
+  it.each(KEYS)("对象键 %s 在嵌套对象与数组里都整体替换", (key) => {
+    const input = { top: { [key]: "SECRETV" }, list: [{ deep: { [key]: "SECRETW" } }], [key]: ["SECRETX"] };
+    const out = redact(input) as Record<string, unknown>;
+    expect(JSON.stringify(out)).not.toMatch(/SECRET[VWX]/);
+    expect((out.top as Record<string, unknown>)[key]).toBe("[REDACTED]");
+    expect(out[key]).toBe("[REDACTED]");
+  });
+
+  it("cookie / x-api-key 请求头行(字符串里)被遮住", () => {
+    const out = redactString("request headers:\ncookie: c_secure_pass=abc; uid=1\nx-api-key: KKKKKKKK\nAccept: */*");
+    expect(out).not.toMatch(/abc|KKKKKKKK/);
+    expect(out).toContain("Accept: */*");
+  });
+
+  it("日志输出里 headers / 数组中的凭证不出现", () => {
+    const { logger, lines } = memoryLogger();
+    logger.warn(
+      {
+        req: { headers: { Cookie: "SECRET_A", "X-Api-Key": "SECRET_B", accept: "json" } },
+        urls: ["https://x/rss?rsskey=SECRET_C", "https://x/dl?torrent_pass=SECRET_D&downhash=SECRET_E"],
+        site: { authKey: "SECRET_F", c_secure_pass: "SECRET_G" },
+        usage: { inputTokens: 42 },
+      },
+      "fetch https://x/?authkey=SECRET_H&c_secure_pass=SECRET_I",
+    );
+    const out = lines.join("");
+    expect(out).not.toMatch(/SECRET_[A-I]/);
+    const line = JSON.parse(lines.at(-1)!);
+    expect(line.req.headers.accept).toBe("json");
+    expect(line.usage.inputTokens).toBe(42);
+  });
+
+  it("与 Agent 的 redactForModel 同源:同一输入得到同样的遮挡结果", async () => {
+    const { redactString: agentRedact } = await import("@umt/agent");
+    const s = "https://x/rss?rsskey=a1&torrent_pass=b2&authkey=c3&downhash=d4&c_secure_pass=e5&passkey=f6";
+    expect(redactString(s)).toBe(agentRedact(s));
+  });
+});