Require karl prefixed bearer secrets

tests/test_api.py

@@ -30,10 +30,10 @@ def test_custom_api_docs_include_only_current_api_surfaces(tmp_path: Path) -> No
     assert redoc.status_code == 404
     assert "Small API surface." in docs.text
     assert "POST /api/v1/hostnames" in docs.text
-    assert "GET or POST /api/v1/router/register/<secret>" in docs.text
-    assert "GET or POST /api/v1/router/update/<secret>" in docs.text
-    assert "GET /api/v1/hostnames/<secret>" in docs.text
-    assert "POST /api/v1/hostnames/<secret>/rotate-update-url" in docs.text
+    assert "GET or POST /api/v1/router/register/<karl_secret>" in docs.text
+    assert "GET or POST /api/v1/router/update/<karl_secret>" in docs.text
+    assert "GET /api/v1/hostnames/<karl_secret>" in docs.text
+    assert "POST /api/v1/hostnames/<karl_secret>/rotate-update-url" in docs.text
     assert "Rotate update URL" in docs.text
     assert "Operator API" not in docs.text
     assert "/api/v1/admin" not in docs.text
@@ -242,7 +242,7 @@ def test_hostname_api_history_is_scoped_to_dashboard_secret(tmp_path: Path) -> N
     assert "source_ip" not in payload["history"][0]
     assert "other.ddns.example.net" not in response.text
     assert client.get(f"/api/v1/hostnames/{other['management_slug']}", params={"history_limit": 101}).status_code == 422
-    assert client.get(f"/api/v1/hostnames/{'a' * 32}").status_code == 404
+    assert client.get(f"/api/v1/hostnames/karl_{'a' * 32}").status_code == 404
 
 
 def test_registration_publishes_initial_dns_when_provider_is_configured(tmp_path: Path, monkeypatch) -> None: