fix(security): close LOW ASVS findings — env bypass, SSE/deployment authz, CN fail-close, password byte-limit, exception leaks, BUG-12..16

Auth/session (V2.1.7, V4.1.5, V4.1.6, V2.1.4/V2.1.5):
- env secret validation no longer bypassed by attacker-injectable PYTEST* env;
  gated on explicit DECNET_TESTING=1 (set only in conftest).
- must_change_password now enforced on the SSE header-JWT path, not just ticket mint.
- GET /system/deployment-mode requires viewer auth (was leaking role + topology size).
- CreateUser/ResetUser passwords min_length=12; passwords >72 bytes rejected
  explicitly instead of bcrypt silently truncating.

Swarm ingestion (V9.1.3, BUG-16):
- Log listener hard-rejects peers with unparseable/empty cert CN (fail closed,
  ingests nothing) instead of tagging 'unknown'.
- Shutdown handlers no longer swallow real errors (narrowed to CancelledError).

Info leakage (V7.1.2, V14.1.2):
- Exception text sanitized on swarm-update, health, tarpit, realism, file-drop,
  blank-topology endpoints (raw tc/docker stderr, DB/Docker errors logged
  server-side, generic detail returned). pyproject license corrected to AGPL-3.0.

Correctness (BUG-12..16):
- BUG-12 atomic credential upsert (UNIQUE constraint + IntegrityError retry,
  consistent principal_key canonicalization).
- BUG-13 rule-tail watermark uses >= with seen-id dedup (no same-second drop).
- BUG-14 worker wake cleared before wait (no lost wake during tick).
- BUG-15 intel gather tolerates an unexpected provider raise.
- BUG-16 see above.

Already-closed (verified, no change): V2.1.6, V5.1.3, V9.1.2. Accept-risk +
documented: V2.1.8 cache window, V3.1.3 idle timeout. Tests added for every fix;
unanimous adversarial review after two refute-fix rounds.

tests/core/test_env_secrets.py

@@ -51,13 +51,34 @@ def test_admin_password_strong_value_passes(monkeypatch: pytest.MonkeyPatch) ->
     assert val == "a-strong-unique-password"
 
 
-def test_pytest_short_circuit_returns_value_unchecked() -> None:
-    # Under live pytest (PYTEST_* present), _require_env returns the configured
-    # value without the production checks — documents why the dev loop is safe.
-    # conftest sets a strong value, so this also proves lazy resolution works.
+def test_testing_flag_short_circuit_returns_value_unchecked() -> None:
+    # Under the test harness (DECNET_TESTING=1, set in conftest), _require_env
+    # returns the configured value without the production checks — documents
+    # why the dev loop is safe. conftest sets a strong value, so this also
+    # proves lazy resolution works.
     assert envmod._require_env("DECNET_ADMIN_PASSWORD") == "test-password-123"
 
 
+def test_pytest_var_leak_does_not_bypass_validation(monkeypatch: pytest.MonkeyPatch) -> None:
+    # V2.1.7 regression: a leaked PYTEST_* env var must NOT disable strength
+    # validation. With DECNET_TESTING unset, a known-bad / short secret is
+    # still rejected even though a PYTEST_* var is present.
+    monkeypatch.setattr(
+        envmod.os,
+        "environ",
+        {"PYTEST_CURRENT_TEST": "x", "DECNET_ADMIN_PASSWORD": "admin"},
+    )
+    with pytest.raises(ValueError):
+        envmod._require_env("DECNET_ADMIN_PASSWORD")
+    monkeypatch.setattr(
+        envmod.os,
+        "environ",
+        {"PYTEST_CURRENT_TEST": "x", "DECNET_ADMIN_PASSWORD": "short1"},
+    )
+    with pytest.raises(ValueError):
+        envmod._require_env("DECNET_ADMIN_PASSWORD")
+
+
 def test_lazy_getattr_resolves_admin_password() -> None:
     # Accessing the attribute (not a module global anymore) routes through
     # __getattr__ -> _require_env.