v1.8.1: shadow:check names the database it audited

[NeverEndingCode]

Closes the gap noticed right after the production gate run: the report proved
100% but never said which database produced that number.

What changed

npm run shadow:check now names the database, twice:

[shadow] auditing sqlite /app/data/rackstack.db
[shadow] MATCH github:37058311 -> github:37058311

=== SuperTokens shadow-mode report ===
database:             sqlite    /app/data/rackstack.db
identities compared:  1
...
GATE: PASS - 100% of comparable identities matched.

Once before the run, so a run that dies partway — missing identities
table, unreadable media — has still said what it was pointed at. That is
exactly the run where an operator most needs to know. And once inside the
report block, because that is the part people tee to a file and paste into
tickets, and a PASS is only meaningful next to the database that produced it.

The gate's own NOT RUN guidance says the usual cause is the wrong database,
so not naming it was a real omission.

The password is stripped

DATABASE_URL carries the database password, and this output gets
screenshotted and shared. So:

postgresql://rackstack_user:hunter2@192.168.1.10:5432/rackstack
  ->  postgres  postgresql://rackstack_user@192.168.1.10:5432/rackstack

Redaction goes through the URL parser, not a regex, so a password containing an
@ cannot survive half-masked — asserted by test. An unparseable
DATABASE_URL says so rather than being echoed back.

Docs brought in line with the production run

The gate passed on 2026-08-08 (Unraid, 6 identities, 6 matched, 0 mismatched,
0 orphaned, GATE: PASS), so several docs were stale:

• The runbook's "what has NOT been verified" list had shadow mode as never run.
  Now struck through with the result — cutover to dual is cleared.
• authentication-methods.md Phase 0 dropped the "supply a production export"
  prerequisite. Running the gate on the container audits the live database,
  which is strictly better than auditing a copy.
• Phase 0's v1.7-on-Postgres item is now honest that the status is unconfirmed
  — and notes the SuperTokens core needs its own Postgres database in Phase 2
  whatever RackStack itself runs on.
• The v1.8.0 changelog entry still says shadow mode had not been run, which was
  accurate at that release; v1.8.1 records that it has.

Verification

• 634 tests SQLite / 660 Postgres (npm run test:all), 39 smoke assertions
• New tests cover: SQLite path shown, Postgres host/database shown, password
  absent, @-containing password not half-masked, unparseable URL handled,
  DATABASE_URL preferred over DB_PATH to match openReader, the line
  present in the report block and above the GATE: line, and omitted entirely
  when no source is supplied (the live per-login path has no single database)

Version bumped to 1.8.1; client/package.json deliberately untouched.

🤖 Generated with Claude Code