fix(auth): address Task 13 deployment review findings

backend/test/startup-error.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+import { formatStartupFailure } from "../src/startup-error.js";
+
+describe("formatStartupFailure", () => {
+  it.each([
+    [new Error("auth_session_store_invalid"), "backend startup failed: auth_session_store_invalid"],
+    [new Error("auth_config_invalid"), "backend startup failed: auth_config_invalid"],
+    [new Error("workspace_registry_invalid"), "backend startup failed: workspace_registry_invalid"],
+  ])("emits only an allowlisted startup cause", (error, expected) => {
+    expect(formatStartupFailure(error)).toBe(expected);
+  });
+
+  it("collapses unknown errors without exposing their message, stack, token, or path", () => {
+    const error = new Error(
+      "EACCES password=plain-secret token=token-secret at /run/secrets/private-token",
+    );
+    error.stack = "Error: raw failure\n    at /app/backend/dist/server.js:42:1";
+
+    const formatted = formatStartupFailure(error);
+
+    expect(formatted).toBe("backend startup failed: startup_unknown");
+    for (const leaked of [
+      "EACCES", "plain-secret", "token-secret", "/run/secrets", "raw failure", "server.js",
+    ]) {
+      expect(formatted).not.toContain(leaked);
+    }
+  });
+});