Test the production rebuild_redactors_for_open_sessions loop with a real AppState #989

Goal

A change to the production loop in app_logic::ext::rebuild_redactors_for_open_sessions is caught by a test, so extensions can rely on secrets being re-registered with the redactor of every open session.

Context

Follow-up of #878 (PR #986): the review noticed that the unit test test_ext_rebuild_redactors_for_open_sessions_touches_open_servers_only (crates/app-logic/src/session/tests.rs) runs a test-only copy of the loop, rebuild_for_open_sessions_with (crates/app-logic/src/ext.rs, #[cfg(test)]), not the production function. The production function rebuild_redactors_for_open_sessions(&AppState) (ext.rs) is only run with zero sessions in crates/app-logic/tests/ext_facade.rs. A change to the production loop (for example dropping the call, or iterating over the wrong servers) would not fail any test. Redaction is security-relevant (see THREAT-MODEL.md).

Requirements

• Exercise the production rebuild_redactors_for_open_sessions with a real AppState that holds open sessions.
• Remove the test-only duplicate rebuild_for_open_sessions_with if it is no longer needed, or keep it only if it still covers something the new test does not.

Acceptance Criteria

• A test builds an AppState with sessions on two servers (one server with two sessions, one server without a session) and calls ext::rebuild_redactors_for_open_sessions(&state).
• The test asserts that exactly the servers with an open session were rebuilt, each once, and that the server without a session was not.
• The test asserts the rebuilt redactor masks a literal secret provided by the (test) SessionExtension.
• Counter-proof: replacing the loop body in the production function with a no-op makes the new test fail; restored, it passes.
• With zero sessions the function is still a no-op.
• Relevant automated tests pass (cargo test -p app-logic, clippy -p app-logic --all-targets)

Technical Notes

Affected: crates/app-logic/src/ext.rs, crates/app-logic/src/session/tests.rs or crates/app-logic/tests/ext_facade.rs. ext_facade.rs builds an AppState in its fixture module but cannot create a session through the facade; a unit test inside the crate (with dummy_session) can build an AppState via crate::test_support. Choose whichever needs no new production API. Do not add a new *_tests.rs file. Test-only change; the redaction logic is not modified.

Spec impact: none

Open questions

None.

Related Work

• Extension API: a documented facade app_logic::ext with accessors instead of AppState fields #878, PR feat(app-logic): documented extension facade app_logic::ext #986