fix(docker-watcher): phase 8 security fixes

Remove webhook secret from logs and API response.
Add auth-pending note to router. Fix decrypt fallback that
would use ciphertext as auth token on decrypt failure.

cmd/server/main.go

@@ -82,7 +82,7 @@ func main() {
 	if err != nil {
 		log.Fatalf("ensure webhook secret: %v", err)
 	}
-	log.Printf("Webhook secret: %s", secret)
+	log.Printf("Webhook secret configured (use /api/settings/webhook-url to retrieve)")
 
 	// Initialize registry poller.
 	poller := registry.NewPoller(db, dep, encKey)