fix(19.8-03): TestServeLifecycle gives serve an app key and http body limits

- serve loads app.key at boot and requires http.body_limits; the
  fixture had neither, so serve returned before listening
- a fixed test-only SUMMER_APP__KEY and a config/http.yaml; the test
  also checks the key never reaches the logs

modules/surf/serve_lifecycle_test.go

@@ -3,6 +3,7 @@ package surf
 import (
 	"bytes"
 	"context"
+	"encoding/base64"
 	"fmt"
 	"net"
 	"net/http"
@@ -92,6 +93,7 @@ func TestServeLifecycle(t *testing.T) {
 	files := map[string]string{
 		"app.yaml":      "name: probe\n",
 		"database.yaml": fmt.Sprintf("dsn: %q\n", dsn),
+		"http.yaml":     "body_limits:\n  default_bytes: 1048576\n  upload_bytes: 1048576\n",
 		"storage.yaml":  fmt.Sprintf("uploads:\n  bucket_url: %q\n", "file://"+t.TempDir()),
 	}
 	for name, body := range files {
@@ -99,7 +101,9 @@ func TestServeLifecycle(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	cfg, err := compass.Open(compass.Options{Dir: dir, Env: "development", Environ: []string{"SUMMER_ENV=development"}})
+	// serve loads app.key at boot (Encrypted columns); a fixed test-only key.
+	appKey := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte("k"), 32))
+	cfg, err := compass.Open(compass.Options{Dir: dir, Env: "development", Environ: []string{"SUMMER_ENV=development", "SUMMER_APP__KEY=" + appKey}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -192,6 +196,9 @@ func TestServeLifecycle(t *testing.T) {
 	if strings.Contains(got, "secret-777") {
 		t.Fatalf("the request path reached the logs:\n%s", got)
 	}
+	if strings.Contains(got, appKey) {
+		t.Fatalf("the app key reached the logs:\n%s", got)
+	}
 	if strings.Contains(got, "surf-pass") {
 		t.Fatalf("the DSN password reached the logs:\n%s", got)
 	}