Require karl prefixed bearer secrets

tests/test_security.py

@@ -21,7 +21,7 @@ def test_generated_hostname_is_not_an_update_secret(tmp_path: Path) -> None:
     client = TestClient(app)
 
     response = client.get(
-        f"/api/v1/router/update/{'a' * 43}",
+        f"/api/v1/router/update/karl_{'a' * 43}",
         params={"hostname": "public-target.ddns.example.net", "myip": "203.0.113.9"},
     )
 
@@ -56,8 +56,8 @@ def test_bearer_link_routes_share_rate_limit_bucket(tmp_path: Path) -> None:
     )
     client = TestClient(app)
 
-    first = client.get(f"/m/{'a' * 43}")
-    second = client.get(f"/m/{'b' * 43}")
+    first = client.get(f"/m/karl_{'a' * 43}")
+    second = client.get(f"/m/karl_{'b' * 43}")
 
     assert first.status_code == 404
     assert second.status_code == 429
@@ -92,6 +92,10 @@ def test_redacted_access_log_masks_bearer_paths_and_query_strings(tmp_path: Path
         "/api/v1/router/register/short",
         "/api/v1/hostnames/short",
         "/m/short",
+        "/api/v1/router/update/not_karl_but_long_enough_1234567890",
+        "/api/v1/router/register/not_karl_but_long_enough_1234567890",
+        "/api/v1/hostnames/not_karl_but_long_enough_1234567890",
+        "/m/not_karl_but_long_enough_1234567890",
     ],
 )
 def test_secret_path_tokens_are_constrained(tmp_path: Path, path: str) -> None: