fix: bound journal credential scan

docs/install/dwh-auth-server.md

@@ -276,21 +276,33 @@ emette solo PASS/FAIL.
 since=$(date -u -d '15 minutes ago' +%Y-%m-%dT%H:%M:%SZ)
 if sudo python3 -c '
 import pathlib, subprocess, sys
+max_journal_bytes = 1_048_576
+max_journal_lines = 10_000
 try:
     actual_keys = {pathlib.Path(path).read_bytes() for path in sys.argv[2:]}
-    result = subprocess.run(
+    process = subprocess.Popen(
         ["journalctl", "-u", "dwh-auth", "--since", sys.argv[1], "--no-pager", "--output=cat"],
-        check=False,
         stdout=subprocess.PIPE,
         stderr=subprocess.DEVNULL,
     )
 except OSError:
     raise SystemExit(2)
-if result.returncode != 0:
+bytes_seen = 0
+try:
+    for line_number, line in enumerate(process.stdout, 1):
+        if line_number > max_journal_lines or bytes_seen + len(line) > max_journal_bytes:
+            process.kill()
+            process.wait()
+            raise SystemExit(2)
+        bytes_seen += len(line)
+        if b"thtdwh_v1" in line or b"secret_sha256" in line or any(key in line for key in actual_keys):
+            raise SystemExit(1)
+finally:
+    if process.poll() is None:
+        process.kill()
+    process.wait()
+if process.returncode != 0:
     raise SystemExit(2)
-for line in result.stdout.splitlines(keepends=True):
-    if b"thtdwh_v1" in line or b"secret_sha256" in line or any(key in line for key in actual_keys):
-        raise SystemExit(1)
 ' "$since" "$v1_key_file" "$legacy_key_file"; then
   printf 'journal_actual_key_scan=PASS\n'
 else