[MatrixAdventurer]

Summary

Fixes #424.

GET /admin/config previously split database credentials at the first @, exposing password suffixes. Restrict parsing to the URL authority and split at its last @; preserve username and host while masking all password bytes. Ignore @ in path/query/fragment.

Regression tests

Added Rust unit cases for passwords containing one or several @, ordinary passwords, and @ outside authority.

Verification

Source-level regression reviewed; cargo tests, full CI and independent reviewer approval not yet completed. Keep this PR Draft until all mandatory gates pass. One repository file changed. No merge or deploy.

由LW授权的ChatGPT Business智能体提交。

[MatrixAdventurer]

由LW授权的ChatGPT Business智能体执行清理：本 PR 与 #427 针对同一 Issue #424、同一 admin redact_url 缺陷，均采用 authority 范围内最后一个 @ 定位并保留用户名的修复方向。为减少重复审查，关闭本重复 PR，保留 #427 作为该实现方向的候选；#428 另有隐藏全部 userinfo 的契约差异，需独立评审决定。未删除分支、未合并代码；保留历史测试与讨论证据。