milestone 13 discrepancies: redact credentials from urls in logs, metrics and cli output

src/web/handlers/mutations.zig

@@ -184,8 +184,12 @@ fn rebuildFailed(what: []const u8, cause: []const u8) Failure {
 const skeleton_group = "default";
 const skeleton_upstream: model.UpstreamServer = .{ .url = "https://dns.example/dns-query" };
 
-/// Runs the shipped validator over `cfg` and returns the first problem's text,
+/// Runs the shipped validator over `cfg` and returns the first failure's text,
 /// or null when the candidate is valid. The text is arena-allocated.
+///
+/// Failures only: a warning describes a configuration that is legal, and a row
+/// this API is about to store cannot be rejected for one. The blocklist source
+/// a POST creates is in no group yet — a warning by design, and never a 400.
 pub fn firstProblem(arena: Allocator, cfg: model.Config) error{OutOfMemory}!?[]const u8 {
     var diags: validate.Diagnostics = .init(arena);
     defer diags.deinit();
@@ -194,8 +198,7 @@ pub fn firstProblem(arena: Allocator, cfg: model.Config) error{OutOfMemory}!?[]c
         error.OutOfMemory => return error.OutOfMemory,
         else => {},
     };
-    if (diags.problems.items.len == 0) return null;
-    const problem = diags.problems.items[0];
+    const problem = diags.firstFailure() orelse return null;
     return try std.fmt.allocPrint(arena, "{s}: {s}", .{ problem.path, problem.message });
 }