test(ingestion): assert the bare token is absent from both auth log lines

PR #181 review (comment 15483):
- TestBuildMuxLogsARESTAuthRejection asserted only that the "Bearer <tok>"
  header form was absent, which a field-logging chassis could never emit.
  Replaced by TestBuildMuxRejectionLogLineOmitsTheBarePresentedToken (a
  sentinel wrong token; neither it nor the static token may appear) and
  TestBuildMuxAcceptedLogLineOmitsTheBareStaticToken. A local chassis
  v0.7.1 copy logging rawToken as token_fp (deny, then accept) turns each red.
- labelRESTPattern doc: the label bound holds for refused requests only;
  the authenticated-404 raw-path gap is hyperguild#185.
- Remove internal/startupretry: nothing imports it since the chassis bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/cmd/server/routes.go

@@ -79,8 +79,12 @@ func mountREST(mux *http.ServeMux, h *api.Handler, auth func(http.Handler) http.
 // labelRESTPattern sets the request's Pattern to the REST route it addresses
 // before auth runs, so the metrics middleware (which reads Pattern from the
 // same *http.Request) labels a refused request by its route rather than by
-// the "/" mount (hyperguild#155). A path no route matches keeps "/", so the
-// label set stays bounded by the registered routes.
+// the "/" mount (hyperguild#155). A refused request to a path no route
+// matches keeps "/", so for refused requests the label set stays bounded by
+// the registered routes. That bound does not hold for authenticated
+// requests: an unregistered path reaches the REST mux, which 404s with an
+// empty Pattern, and the metrics middleware falls back to the raw URL path
+// (hyperguild#185).
 func labelRESTPattern(rest *http.ServeMux, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if _, pattern := rest.Handler(r); pattern != "" {