Makes the application say what it is doing and when it fails

U4. Console logging plus Sentry, a same-origin tunnel so ad blockers cannot
silence browser errors, Umami on the admin SPA, and six security events that
alert rules can actually be built on.

The correlation id is the W3C trace id from the ambient Activity, enabled by
one line of ActivityTrackingOptions so every entry from every category carries
it without touching a call site. It propagates across the master/slave
boundary via traceparent, which TraceIdentifier cannot do at all, and it is
the same value ProblemDetails already returns to the browser.

The security events use source-generated LoggerMessage with constant
templates. Sentry groups log events by message, so interpolating an email
address would give every address its own issue and "more than 20 failed
logins in five minutes" could never fire — the events would arrive, be
visible, be tagged, and the alerting would silently be impossible. A test
asserts the rendered message is identical across argument values.

Scrubbing happens in-process, before transmission, and covers Set-Cookie as
well as Cookie: the login response issues the refreshToken there, so
scrubbing only the request side would protect nothing. Transactions are
scrubbed too, because they carry request data and are the channel nobody
thinks of.

The tunnel derives its destination from the DSN once at startup and reads
nothing from the request, which is what separates a tunnel from a
server-side request forgery primitive. Size is capped by a bounded read
rather than by trusting Content-Length, and the endpoint is rate limited.

Two things found along the way. Zod 4's url() hands the value to the URL
constructor, which accepts any scheme — so the existing frontend validation
would have accepted the exact "htp://" typo BR-U4-24 names, and the SPA
would have called a nonexistent origin. Now constrained to http(s). And the
new appsettings comments are verified against the real configuration
provider, because the failure mode if it rejected them is both hosts
refusing to start after a release switch.

One deviation. IAdminTokenValidator was meant to gain a reason-reporting
overload; implemented that way, a substitute returning false by default
silently inverted the access decision while both methods compiled. Two
methods whose difference is invisible at the call site is the defect, so it
is now a single Validate returning AdminTokenResult.

Touches two files from already-committed units: DatabaseMigrationExtensions
(U2) gains a flush before the rethrow, or the one Critical event in the
system dies with the process; AdminTokenValidator (U1) classifies why a
bypass was refused.

Build 0 errors; 366 backend tests pass, up from 315, and 237 frontend tests,
up from 213. tsc clean, eslint clean on every changed file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHoJpxYXzHACSQguHrC5fw

src/SlpModularCms.Modules.Availability/Controllers/MasterController.cs

@@ -1,4 +1,6 @@
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
+using SlpModularCms.Core.Observability;
 using SlpModularCms.Modules.Availability.Models;
 using SlpModularCms.Modules.Availability.Services;
 
@@ -9,36 +11,60 @@ namespace SlpModularCms.Modules.Availability.Controllers;
 public class MasterController : ControllerBase
 {
     private readonly IMasterAvailabilityService _svc;
+    private readonly ILogger<MasterController> _logger;
 
-    public MasterController(IMasterAvailabilityService svc) => _svc = svc;
+    public MasterController(IMasterAvailabilityService svc, ILogger<MasterController> logger)
+    {
+        _svc = svc;
+        _logger = logger;
+    }
 
     [HttpPost("register")]
     public async Task<IActionResult> Register([FromBody] RegisterMasterRequest request)
     {
         var apiKey = Request.Headers["X-Master-Api-Key"].FirstOrDefault();
-        if (string.IsNullOrEmpty(apiKey)) return Unauthorized();
+        if (string.IsNullOrEmpty(apiKey)) return RejectKey();
 
         var success = await _svc.RegisterAsync(request.MasterUrl, apiKey);
-        return success ? Ok() : Unauthorized();
+        return success ? Ok() : RejectKey();
     }
 
     [HttpPost("status")]
     public async Task<IActionResult> PushStatus([FromBody] PushStatusRequest request)
     {
         var apiKey = Request.Headers["X-Master-Api-Key"].FirstOrDefault();
-        if (string.IsNullOrEmpty(apiKey)) return Unauthorized();
+        if (string.IsNullOrEmpty(apiKey)) return RejectKey();
 
         var success = await _svc.PushStatusAsync(apiKey, request.IsAvailable, request.DisableMessage);
-        return success ? Ok() : Unauthorized();
+        return success ? Ok() : RejectKey();
     }
 
     [HttpGet("registered-url")]
     public async Task<IActionResult> GetRegisteredUrl()
     {
         var apiKey = Request.Headers["X-Master-Api-Key"].FirstOrDefault();
-        if (string.IsNullOrEmpty(apiKey)) return Unauthorized();
+        if (string.IsNullOrEmpty(apiKey)) return RejectKey();
 
         var url = await _svc.GetRegisteredUrlAsync(apiKey);
-        return url is not null ? Ok(new { MasterUrl = url }) : Unauthorized();
+        return url is not null ? Ok(new { MasterUrl = url }) : RejectKey();
+    }
+
+    /// <summary>
+    /// Reports the rejection and returns 401. Never logs the key or any part of it.
+    /// </summary>
+    /// <remarks>
+    /// This event is ambiguous by nature: it means either an intruder, or that the Data
+    /// Protection key ring has become unreadable so a legitimate master can no longer be
+    /// recognised. The durability work exists to make the second cause impossible, but if it ever
+    /// happens this is the first sign of it — and the two need telling apart quickly.
+    /// </remarks>
+    private IActionResult RejectKey()
+    {
+        SecurityEvents.MasterApiKeyRejected(
+            _logger,
+            Request.Path,
+            HttpContext.Connection.RemoteIpAddress?.ToString() ?? "(unknown)");
+
+        return Unauthorized();
     }
 }

src/SlpModularCms.Modules.Availability/Middleware/AvailabilityMiddleware.cs

@@ -3,6 +3,7 @@ using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 using SlpModularCms.Core.Availability;
 using SlpModularCms.Core.Hosting.Security;
+using SlpModularCms.Core.Observability;
 using SlpModularCms.Modules.Availability.Services;
 
 namespace SlpModularCms.Modules.Availability.Middleware;
@@ -109,6 +110,17 @@ public class AvailabilityMiddleware
     /// </remarks>
     private bool IsAdminBypass(HttpContext context)
     {
-        return _adminTokenValidator.IsVerifiedAdmin(context.Request.Headers.Authorization.ToString());
+        var result = _adminTokenValidator.Validate(context.Request.Headers.Authorization.ToString());
+
+        // A rejected bypass only became a meaningful signal once the gate started verifying
+        // signatures: before that, a forged token succeeded silently. An absent header is not
+        // reported — every anonymous request to a disabled instance has one, so reporting it
+        // would drown the cases that matter.
+        if (!result.IsVerifiedAdmin && result.Reason != BypassRejectionReason.Absent)
+        {
+            SecurityEvents.AdminBypassRejected(_logger, context.Request.Path, result.Reason);
+        }
+
+        return result.IsVerifiedAdmin;
     }
 }