fix(security): close INFO ASVS findings — secret echo, TLS floor, mandatory tarball SHA, CORS/Content-Type guards, BUG-17

- V7.1.3: env known-insecure-default error no longer echoes the rejected secret value.
- V9.1.4: syslog-over-TLS forwarder + listener pin minimum_version=TLSv1_2.
- V12.1.2: updater tarball SHA-256 verification is now mandatory and fail-closed —
  /update and /update-self reject a missing digest (400), the executor rejects
  missing/mismatched digests before extract/apply. Every push path supplies it.
- V13.1.4: reject a wildcard '*' in DECNET_CORS_ORIGINS at startup.
- V13.1.5: enforce application/json on JSON write endpoints (415 otherwise),
  exempting multipart upload routes.
- BUG-17: SSE error log records the user uuid, not the resume cursor.

Also completes V2.1.7 consistently: the attacker-injectable PYTEST* env bypass is
replaced with explicit DECNET_TESTING=1 in the three remaining sites
(env.validate_public_binding, config logging, mysql url builder).

Tests added for every fix; unanimous adversarial review (no update-outage risk —
all push paths verified to send the digest).

tests/core/test_env_secrets.py

@@ -4,7 +4,7 @@
 DECNET_ADMIN_PASSWORD must never silently default to "admin": it is resolved
 lazily and validated like DECNET_JWT_SECRET. These tests drive _require_env
 against a controlled environ so the production raise paths (which are bypassed
-under live pytest) are actually exercised.
+under the test harness via DECNET_TESTING=1) are actually exercised.
 """
 from __future__ import annotations
 
@@ -14,8 +14,8 @@ import decnet.env as envmod
 
 
 def _require(monkeypatch: pytest.MonkeyPatch, environ: dict[str, str]) -> str:
-    # Replace the whole environ for the call so the PYTEST_* short-circuit in
-    # _require_env doesn't fire — we want the real production behaviour.
+    # Replace the whole environ for the call so the DECNET_TESTING short-circuit
+    # in _require_env doesn't fire — we want the real production behaviour.
     monkeypatch.setattr(envmod.os, "environ", dict(environ))
     return envmod._require_env("DECNET_ADMIN_PASSWORD")
 
@@ -36,6 +36,20 @@ def test_admin_password_other_known_bad_raises(monkeypatch: pytest.MonkeyPatch,
         _require(monkeypatch, {"DECNET_ADMIN_PASSWORD": bad})
 
 
+def test_known_bad_message_does_not_leak_secret_value(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    # V7.1.3: the known-bad rejection must NOT echo the rejected secret value
+    # (it would land in logs / stderr / crash reporters). Name the variable,
+    # not its value.
+    secret = "admin"
+    with pytest.raises(ValueError) as exc:
+        _require(monkeypatch, {"DECNET_ADMIN_PASSWORD": secret})
+    msg = str(exc.value)
+    assert secret not in msg
+    assert "DECNET_ADMIN_PASSWORD" in msg
+
+
 def test_admin_password_too_short_raises_in_production(monkeypatch: pytest.MonkeyPatch) -> None:
     with pytest.raises(ValueError, match="too short"):
         _require(monkeypatch, {"DECNET_ADMIN_PASSWORD": "short1"})