fix(security): redact CDC stop diagnostics

[seonghobae]

Fixes #259.

Strict test-first confidentiality repair from exact protected develop@942d164ceb7af497bb28a95f842db96429d1bdc4.

RED candidate

Exact test-only head 271a7fd2a4ceea96d8c80114c1bb766cc520ae01 changes only CdcControllerTest. It injects an IOException containing unmistakably sensitive broker/password/path diagnostic text and requires the HTTP 500 response to expose only the stable generic message Error stopping CDC process.

Protected production currently concatenates IOException.getMessage() into the response body, so the focused test is expected to fail at the public HTTP controller boundary. The synthetic diagnostic is test-only and must not be logged.

Keep Draft through fail-first proof. After hosted RED reaches the intended boundary, apply only the narrow response redaction, preserve status and stop invocation semantics, rerun focused/full validation, and keep inherited/shared scanner, non-vacuous coverage, literal-source, and independent-review governance gaps separate.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5bff18f2-2824-46a7-9f6a-988e86a75dca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing as a proven duplicate of #172, not as completed work. #172 already contains the same shutdown-diagnostic confidentiality behavior with prior hosted RED→GREEN evidence, and its regression is stricter (credential-bearing JDBC diagnostic plus stable generic 500 response) while also preserving stop invocation/status semantics. This test-only branch adds no unique production behavior that is not already covered there. Issue #259 remains open until the protected branch actually integrates an accepted fix.