test(coverage): batch 1 — Top-15 sequencing #1-#7

[blackaxgit]

Lands the smallest, highest-leverage entries from the v2 test plan's Top-15.

What this adds (7 tests, ~180 LoC)

ID	What
TC-CRED-011	SecretString Debug must not leak the value (security invariant)
TC-MIG-006	column_exists rejects unsafe table names (SQL injection guard)
TC-AUD-002	Synthetic session_id auto-creates session row (closes 0.7.1 documentation lie)
TC-AUD-003	Auto-created session has placeholder source/status fields
TC-AUD-008	Command redaction pipeline survives round-trip through audit table
TC-AZ-013 (set)	Dated URL shape when api_version is set
TC-AZ-013 (unset)	v1 URL shape when api_version is None

Plan reference

Per specs/2026-05-02-comprehensive-test-plan.md Top-15 sequencing items #1-#7. Bundle picked for highest coverage_payoff/effort ratio.

Honesty fix

TC-AUD-002 was listed in v1 of the test plan as the regression test for the 0.7.1 audit-FK fix but never actually existed (documentation lie flagged by the critique agent). This PR closes that gap.

Test plan

• cargo test --workspace clean
• cargo clippy --workspace --all-targets --all-features -- -D warnings clean
• cargo fmt --all -- --check clean
• CI green on the PR