fix: resolve security review findings on .env.example template (E00-S04-T05)

Addresses PR #404 review findings F2/F3/F4 on issue #186:

- F3 (fail-closed): ship EPPP_SESSION_SECRET placeholder as `change-me`
  (9 chars), shorter than the schema's 32-character minimum, so an
  unedited `cp .env.example .env` is rejected at startup instead of
  booting with a publicly known secret.
- F2 (gitleaks-clean): build the secret-shaped mutation-probe literal at
  runtime from short non-secret fragments; the branch no longer embeds a
  secret-shaped literal in the test source.
- F4 (masked messages): assertion messages mask/truncate values that come
  from the template instead of echoing the raw string.
- test: add a fail-closed length test for the EPPP_SESSION_SECRET
  placeholder (< 32 chars); keep mutation probes non-vacuous.

.gitea/workflows/ci.yml

@@ -294,8 +294,11 @@ jobs:
   # source (HOST/PORT/DATABASE_URL/EPPP_SESSION_SECRET), and contains
   # placeholder values only — no credential URI, no long secret-looking value,
   # and no compose default credential — with mutation probes proving the
-  # assertions are non-vacuous. The test needs no dependencies, so the job
-  # only installs Node.
+  # assertions are non-vacuous. It also locks the fail-closed EPPP_SESSION_SECRET
+  # placeholder (shorter than the schema's 32-character minimum), builds the
+  # secret-shaped probe at runtime so the branch stays gitleaks-clean, and
+  # masks raw values in assertion messages. The test needs no dependencies, so
+  # the job only installs Node.
   env-example:
     name: .env.example placeholders only (E00-S04-T05)
     runs-on: ubuntu-latest