feat: security hardening — URL secret redaction + bounded error-body reads

[lesnik512]

Summary

Closes the security cluster from the 2026-06-14 deep audit — the dimensions (security/supply-chain) the prior audit never covered. Design + plan: planning/changes/active/2026-06-14.03-security-hardening/.

1. URL secret redaction (3 leakage findings). New _internal/redaction.py::redact_url strips user:pass@ userinfo and masks the values of known-sensitive query and fragment keys (case-insensitive, whitespace-tolerant). Wired into:

• StatusError._summary / __repr__ (replaces the userinfo-only _strip_userinfo)
• every resilience-middleware event URL, via a single _observed_url(request) helper (so a new emit site can't silently re-leak)

Benign URLs (no sensitive key) pass through byte-identical.

2. Bounded error-body read (streaming finding). New public ResponseTooLargeError + opt-in max_error_body_bytes: int | None = None on both AsyncClient and Client. When set, stream() raises on a 4xx/5xx whose declared Content-Length exceeds the cap before reading the body. None default = unchanged behavior. Honest residual (documented): a chunked error body with no declared length is still read, because a true mid-read cap would require httpx2's private _content (banned by repo invariant). The non-streaming hard cap is recorded in planning/deferred.md.

3. Docs. trust_env proxy default, the bounded-body residual, and a StatusError.response.request header-reachability callout (Authorization/Cookie are not stripped — redact before logging).

Also: a small coverage-config improvement (exclude pytest.fail() lines globally instead of per-line pragmas).

Test plan

• redact_url unit tests: userinfo (incl. IPv6/port), each sensitive key, fragment, whitespace-padded keys, repeated keys, benign byte-identical passthrough
• Leakage tests assert both secret-absence and the REDACTED form — for StatusError messages and resilience events (sync + async)
• Bounded-read tests: over-cap raises ResponseTooLargeError without reading; under-cap / no-cap still populate exc.response.content (sync + async); _parse_content_length is total
• ResponseTooLargeError pickle round-trip + public-API export
• just test — 602 passed, 100% coverage
• just lint — ruff + ty clean
• Invariants: no httpx2._, no raw str(request.url) in middleware, no print(), no from __future__

🤖 Generated with Claude Code