Simplify pending setup secrets

tests/test_api.py

@@ -161,6 +161,9 @@ def test_hostname_api_lifecycle_and_history(tmp_path: Path) -> None:
     dashboard_secret = body["dashboard_url"].rsplit("/", 1)[1]
     update_path = _path(body["update_url"])
     register_path = _path(body["registration_url"])
+    assert dashboard_secret.startswith("karl_")
+    assert update_path.rsplit("/", 1)[1].startswith("karl_")
+    assert register_path.rsplit("/", 1)[1].startswith("karl_")
 
     pending = client.get(f"/api/v1/hostnames/{dashboard_secret}")
     assert pending.status_code == 200
@@ -214,6 +217,7 @@ def test_hostname_api_can_rotate_update_url(tmp_path: Path) -> None:
     assert rotated.status_code == 200
     assert rotated.json()["hostname"] == body["hostname"]
     assert rotated.json()["update_url"] != body["update_url"]
+    assert new_update_path.rsplit("/", 1)[1].startswith("karl_")
     assert client.get(old_update_path, params={"myip": "203.0.113.11"}).status_code == 404
     assert client.get(new_update_path, params={"myip": "203.0.113.12"}).status_code == 200