test(ingestion): assert the bare token is absent from both auth log lines

PR #181 review (comment 15483):
- TestBuildMuxLogsARESTAuthRejection asserted only that the "Bearer <tok>"
  header form was absent, which a field-logging chassis could never emit.
  Replaced by TestBuildMuxRejectionLogLineOmitsTheBarePresentedToken (a
  sentinel wrong token; neither it nor the static token may appear) and
  TestBuildMuxAcceptedLogLineOmitsTheBareStaticToken. A local chassis
  v0.7.1 copy logging rawToken as token_fp (deny, then accept) turns each red.
- labelRESTPattern doc: the label bound holds for refused requests only;
  the authenticated-404 raw-path gap is hyperguild#185.
- Remove internal/startupretry: nothing imports it since the chassis bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/cmd/server/routes_observability_test.go

@@ -13,20 +13,41 @@ import (
 	"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
 )
 
+// wrongTokSentinel is a presented credential distinctive enough that any
+// occurrence in a log line is the raw token, not a coincidence.
+const wrongTokSentinel = "wrong-tok-sentinel-q7zx"
+
 // hyperguild#155: since #149 every REST route sits behind BearerMiddleware,
 // and chassis v0.2.0 refused without logging, so an unknown caller got
-// silent 401s. The chassis now writes an `mcp auth rejected` line.
-func TestBuildMuxLogsARESTAuthRejection(t *testing.T) {
+// silent 401s. The chassis now writes an `mcp auth rejected` line, and the
+// presented token appears nowhere in the log as a bare value (PR #181
+// review: asserting on the "Bearer " header form could never fail, since
+// the chassis logs fields, not headers).
+func TestBuildMuxRejectionLogLineOmitsTheBarePresentedToken(t *testing.T) {
 	var buf bytes.Buffer
 	prev := slog.Default()
 	slog.SetDefault(slog.New(slog.NewTextHandler(&buf, nil)))
 	t.Cleanup(func() { slog.SetDefault(prev) })
 
-	code, _ := do(t, testMux(t), "POST", "/query", "Bearer wrong")
+	code, _ := do(t, testMux(t), "POST", "/query", "Bearer "+wrongTokSentinel)
 	require.Equal(t, http.StatusUnauthorized, code)
 	assert.Contains(t, buf.String(), "mcp auth rejected")
 	assert.Contains(t, buf.String(), "path=/query")
-	assert.NotContains(t, buf.String(), "Bearer wrong", "the credential itself is never logged")
+	assert.NotContains(t, buf.String(), wrongTokSentinel, "the rejected token is logged as a bare value")
+	assert.NotContains(t, buf.String(), routesTok, "the valid static token is logged")
+}
+
+// The `mcp auth accepted` line leaves out the valid static token.
+func TestBuildMuxAcceptedLogLineOmitsTheBareStaticToken(t *testing.T) {
+	var buf bytes.Buffer
+	prev := slog.Default()
+	slog.SetDefault(slog.New(slog.NewTextHandler(&buf, nil)))
+	t.Cleanup(func() { slog.SetDefault(prev) })
+
+	code, _ := do(t, testMux(t), "GET", "/pending", "Bearer "+routesTok)
+	require.Equal(t, http.StatusOK, code)
+	assert.Contains(t, buf.String(), "mcp auth accepted")
+	assert.NotContains(t, buf.String(), routesTok, "the accepted static token is logged as a bare value")
 }
 
 // An authenticated REST request is labelled with the REST mux's pattern: