row 74 F25: a base URL's or token endpoint's userinfo rides as Authorization: Basic where 1.5.5 sent it; no plane receives it

[MattJackson]

Stacked on #876 (base lane-row74-userinfo). That PR strips the userinfo; this one adds the ARCHITECT ruling on top: 1.5.5 wins on Authorization: Basic, and a plane never receives a URL that carries userinfo.

1.5.5 citations

• Lane requests: 1.5.5 built them with reqwest over {base_url}{path}, with the credential added after. See v1.5.5 crates/busbar/src/proxy/engine/mod.rs:1669-1670, proxy/engine/walk.rs:583-584 and health.rs:313-314.
• oauth-client-credentials mint: crates/busbar/src/egress_auth/oauth_client_credentials.rs:119-126, .post(&self.token_url).form(..).
• jwt-bearer mint: crates/busbar/src/egress_auth/jwt_bearer.rs:175-181, .post(&self.token_uri).form(..).
• reqwest 0.12.28: RequestBuilder::new (src/async_impl/request.rs:169-182) takes the userinfo out (extract_authority, :581-605, percent-decoded) and adds it FIRST as a sensitive authorization: Basic (src/util.rs:4-25). .headers(auth) (replace_headers, src/util.rs:50-77) replaces it only when the credential is itself named authorization. A form POST has no authorization field, so the mints always carried it.

What

• Base URL: the kernel holds the Basic value as UrlUserinfo, an opaque value that never prints. Both send paths put it first unless the request already has authorization:
  • the in-process lane's send, through the kernel's owned client, handed in as a request extension;
  • the door path's attempt head, in far_end.
• token_url, door path: OutboundAuths::serving_with strips the URL before the auth plugin opens and before its binding. The plugin's connection table is wrapped so each mint leads with the Basic value.
• token_url, in-process lane: the userinfo is stripped before the plane sees the URL (LaneInput.token_url). The Basic value goes alongside as LaneInput.token_userinfo, through the kernel's bind_presenting, to the new AuthAxis::serving_presenting.
• jwt-bearer token_uri: the same rule. The mint need is pinned to the stripped endpoint and each mint leads with the Basic value. The assertion's aud stays the plugin's own reading of the service account, as in 1.5.5.
• Messages: validation and seal refusals repeat base_url, token_url and token_uri with the userinfo redacted. The message literals are unchanged.
• Scope: no wider than these three URLs.

REDs

• Kernel:
  • The reqwest decode rules and the Basic value they produce.
  • The send hop's order and condition.
  • A wire test through the owned client: an x-api-key credential gets Basic first; an authorization credential gets none.
  • far_end: an x-api-key binding gets Basic first; a Bearer binding gets none.
  • The endpoint a plane is handed carries no userinfo, and the auth axis receives the Basic value next to the settings, never inside them.
• busbar-llm:
  • A keyless lane's organic forward reaches the stripped host with the Basic value.
  • A probe with an authorization credential carries the credential alone.
• Root:
  • The OAuth member test runs once with a plain token_url and once with a userinfo token_url: the need is pinned to the stripped endpoint and the userinfo version's mints lead with Basic.
  • A service-account token_uri with userinfo seals, is pinned to and dialled at the stripped endpoint, and each mint leads with Basic.
  • The in-process shape (stripped settings plus the held Basic) leads the token POST with Basic.
• config_validate: a planted scan of every base_url and token_url refusal finds no svcuser or hunter2.

[MattJackson]

FYI (queue rule 20): $ draft #870 also edits crates/busbar-kernel/src/config_validate/{mod.rs:1553 rate-refusal message, tests/tests.rs:4178-4216 rate test}; hunks are disjoint from yours and merge clean.

[MattJackson]

row 155 B2 (#974) edits crates/busbar-kernel/src/bound_credential.rs at DeclaredBuilder::headers_for; disjoint from this PR's hunks.

[MattJackson]

Rule 20 note from #1031 (row 155, draft): disjoint hunks in root/door_steps.rs (kernel_sections limits) and root/tests/door_steps.rs (one test appended). A test merge is clean.