fix(security): W4-E1 approvals admin-session only, shared redact table, TMDB key redaction, prod mock gate

- POST /approvals and PATCH /approvals/{id} require a console admin session
  (EndpointDef auth:"session"); API keys incl. admin scope get 403, so an
  organize.execute key can no longer approve its own plan (S1)
- tests for single-use approval checks: expired, revision/payload hash
  mismatch, consumed, revoked, pending/rejected, plan mismatch; re-approve
  after plan change succeeds once and cannot be replayed (S4)
- one redact key table in @umt/contracts shared by server logger and agent
  redactForModel: rsskey, torrent_pass, authkey, downhash, c_secure_pass,
  passkey variants, x-api-key, cookie headers, nested objects/arrays (S2)
- TMDB network errors: message and cause redacted via redactUrl (S3)
- web Agent ?mock=1 only in DEV builds or when pi.provider is fake (S7)
- EndpointDef auth annotations for /auth/*, asserted against
  PUBLIC_AUTH_PATHS (S10); doc drift fixes (S11)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/redact.ts

@@ -0,0 +1,87 @@
+/**
+ * 凭证脱敏的唯一键表与字符串规则(服务端 logger、Agent 模型上下文、适配器错误信息共用)。
+ * 覆盖 cookie / passkey / rsskey / torrent_pass / authkey / downhash / c_secure_pass / token / apiKey /
+ * authorization / x-api-key 头 / URL 内嵌账号密码。键名先规范化(小写、去掉 - _ 空白)再判断,
+ * 所以 PassKey、pass-key、pass_key、X-Api-Key 都能命中。
+ * 宁可多遮不可漏遮:误伤只影响可读性,漏遮会把凭证送进日志或外部模型。
+ */
+export const REDACTED = "[REDACTED]";
+
+/** 规范化后的键名只要包含其中一项即视为敏感 */
+export const SENSITIVE_KEY_PARTS: readonly string[] = [
+  "cookie",
+  "passkey",
+  "authkey",
+  "torrentpass",
+  "securepass",
+  "rsskey",
+  "downhash",
+  "apikey",
+  "authorization",
+  "secret",
+  "password",
+  "passwd",
+  "credential",
+  "privatekey",
+];
+
+/** 规范化键名(去掉 - _ 空白并小写)后判断。以 token 结尾算敏感,tokens(用量统计)不算。 */
+export function isSensitiveKey(key: string): boolean {
+  const k = key.toLowerCase().replace(/[-_\s]/g, "");
+  if (k.endsWith("token")) return true;
+  if (k === "sign" || k === "signature") return true;
+  return SENSITIVE_KEY_PARTS.some((part) => k.includes(part));
+}
+
+/** URL 查询参数/片段中视为凭证的参数名(正则片段,大小写不敏感;- _ 可选的写成 [_-]?) */
+export const SENSITIVE_QUERY_PARAMS: readonly string[] = [
+  "pass[_-]?key",
+  "auth[_-]?key",
+  "torrent[_-]?pass",
+  "rss[_-]?key",
+  "c[_-]?secure[_-]?pass",
+  "down[_-]?hash",
+  "api[_-]?key",
+  "access[_-]?token",
+  "refresh[_-]?token",
+  "token",
+  "auth",
+  "sign",
+  "signature",
+  "credential",
+  "secret",
+  "password",
+  "uid[_-]?key",
+  "key",
+];
+
+const PARAM_RE = new RegExp(`([?&;#]|\\b)(${SENSITIVE_QUERY_PARAMS.join("|")})=([^&;#\\s"'<>]+)`, "gi");
+const URL_USERINFO_RE = /\b([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]+)@/gi;
+const BEARER_RE = /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{6,}/g;
+const HEADER_RE = /\b(cookie|set-cookie|authorization|x-api-key)\s*:\s*[^\r\n]+/gi;
+const KNOWN_KEY_RE = /\b(sk-[A-Za-z0-9_-]{8,}|sk-ant-[A-Za-z0-9_-]{8,}|gh[pousr]_[A-Za-z0-9]{16,})\b/g;
+
+/** 文本脱敏:请求头行、URL userinfo、query 凭证参数、Bearer/Basic、已知格式的密钥 */
+export function redactString(input: string): string {
+  return input
+    .replace(HEADER_RE, (_m, name: string) => `${name}: ${REDACTED}`)
+    .replace(URL_USERINFO_RE, (_m, scheme: string) => `${scheme}${REDACTED}@`)
+    .replace(PARAM_RE, (_m, lead: string, name: string) => `${lead}${name}=${REDACTED}`)
+    .replace(BEARER_RE, (_m, scheme: string) => `${scheme} ${REDACTED}`)
+    .replace(KNOWN_KEY_RE, REDACTED);
+}
+
+/**
+ * URL(或含 URL 的错误信息)脱敏。`secrets` 为调用方已知的明文凭证,出现在任何位置都会被替换
+ * (兜底 fetch 实现把 URL 编码后再拼进错误信息之类的情况)。
+ */
+export function redactUrl(input: string, secrets: readonly (string | undefined | null)[] = []): string {
+  let out = redactString(input);
+  for (const s of secrets) {
+    if (!s || s.length < 4) continue;
+    out = out.split(s).join(REDACTED);
+    const enc = encodeURIComponent(s);
+    if (enc !== s) out = out.split(enc).join(REDACTED);
+  }
+  return out;
+}