fix(docker-watcher): phase 8 security fixes

Remove webhook secret from logs and API response.
Add auth-pending note to router. Fix decrypt fallback that
would use ciphertext as auth token on decrypt failure.

internal/api/router.go

@@ -35,6 +35,8 @@ func NewServer(
 }
 
 // Router returns a chi router with all API routes mounted.
+// NOTE: Authentication middleware is added in Phase 12 (Hardening).
+// Until then, this API should only be exposed on trusted networks.
 func (s *Server) Router() chi.Router {
 	r := chi.NewRouter()