fix(security): close INFO ASVS findings — secret echo, TLS floor, mandatory tarball SHA, CORS/Content-Type guards, BUG-17

- V7.1.3: env known-insecure-default error no longer echoes the rejected secret value.
- V9.1.4: syslog-over-TLS forwarder + listener pin minimum_version=TLSv1_2.
- V12.1.2: updater tarball SHA-256 verification is now mandatory and fail-closed —
  /update and /update-self reject a missing digest (400), the executor rejects
  missing/mismatched digests before extract/apply. Every push path supplies it.
- V13.1.4: reject a wildcard '*' in DECNET_CORS_ORIGINS at startup.
- V13.1.5: enforce application/json on JSON write endpoints (415 otherwise),
  exempting multipart upload routes.
- BUG-17: SSE error log records the user uuid, not the resume cursor.

Also completes V2.1.7 consistently: the attacker-injectable PYTEST* env bypass is
replaced with explicit DECNET_TESTING=1 in the three remaining sites
(env.validate_public_binding, config logging, mysql url builder).

Tests added for every fix; unanimous adversarial review (no update-outage risk —
all push paths verified to send the digest).

decnet/web/db/mysql/database.py

@@ -50,12 +50,14 @@ def build_mysql_url(
     if password is None:
         password = os.environ.get("DECNET_DB_PASSWORD") or ""
 
-    # Allow empty passwords during tests (pytest sets PYTEST_* env vars).
-    # Outside tests, an empty MySQL password is almost never intentional.
-    if not password and not any(k.startswith("PYTEST") for k in os.environ):
+    # Allow empty passwords during tests, gated on the explicit, non-attacker-
+    # injectable DECNET_TESTING=1 flag (set by the test harness) rather than
+    # the attacker-controllable PYTEST* namespace (V2.1.7). Outside tests, an
+    # empty MySQL password is almost never intentional.
+    if not password and os.environ.get("DECNET_TESTING") != "1":
         raise ValueError(
             "DECNET_DB_PASSWORD is not set. Either export it, set DECNET_DB_URL, "
-            "or run under pytest for an empty-password default."
+            "or run under the test harness (DECNET_TESTING=1) for an empty-password default."
         )
 
     pw_enc = quote_plus(password)