fix(config): redact MasterKey type; drop os.Clearenv; add hex validation test

internal/config/config_test.go

@@ -1,7 +1,8 @@
 package config
 
 import (
-	"os"
+	"encoding/json"
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -27,8 +28,8 @@ func TestLoad_FromEnv(t *testing.T) {
 }
 
 func TestLoad_MissingMasterKey(t *testing.T) {
-	os.Clearenv()
 	t.Setenv("APP_DB_DSN", "x")
+	t.Setenv("APP_MASTER_KEY", "") // explicitly empty so t.Setenv cleans up
 	_, err := Load("")
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "MASTER_KEY")
@@ -40,3 +41,21 @@ func TestLoad_MasterKeyWrongLength(t *testing.T) {
 	_, err := Load("")
 	require.Error(t, err)
 }
+
+func TestLoad_MasterKeyNotHex(t *testing.T) {
+	t.Setenv("APP_DB_DSN", "x")
+	t.Setenv("APP_MASTER_KEY", "zz") // not valid hex
+	_, err := Load("")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "invalid hex")
+}
+
+func TestMasterKey_Redaction(t *testing.T) {
+	k := MasterKey([]byte{0x01, 0x02, 0x03})
+	require.Equal(t, "[REDACTED 32B]", k.String())
+	require.Equal(t, "[REDACTED 32B]", fmt.Sprintf("%v", k))
+	require.NotContains(t, fmt.Sprintf("%v", k), "01")
+	b, err := json.Marshal(k)
+	require.NoError(t, err)
+	require.Equal(t, `"[REDACTED]"`, string(b))
+}