fix(docker-watcher): phase 8 security fixes

Remove webhook secret from logs and API response.
Add auth-pending note to router. Fix decrypt fallback that
would use ciphertext as auth token on decrypt failure.

internal/api/registries.go

@@ -195,10 +195,10 @@ func (s *Server) testRegistry(w http.ResponseWriter, r *http.Request) {
 	if token != "" {
 		decrypted, err := crypto.Decrypt(s.encKey, token)
 		if err != nil {
-			token = reg.Token // Fall back to raw token.
-		} else {
-			token = decrypted
+			respondError(w, http.StatusInternalServerError, "failed to decrypt registry token")
+			return
 		}
+		token = decrypted
 	}
 
 	client, err := registry.NewClient(reg.Type, reg.URL, token)
@@ -239,10 +239,10 @@ func (s *Server) listRegistryTags(w http.ResponseWriter, r *http.Request) {
 	if token != "" {
 		decrypted, err := crypto.Decrypt(s.encKey, token)
 		if err != nil {
-			token = reg.Token
-		} else {
-			token = decrypted
+			respondError(w, http.StatusInternalServerError, "failed to decrypt registry token")
+			return
 		}
+		token = decrypted
 	}
 
 	client, err := registry.NewClient(reg.Type, reg.URL, token)