fix: corrige 6 bugs mineurs (BUG-035 a BUG-040)

tests/test_api_main.py

@@ -743,6 +743,33 @@ class TestSecretRedactor:
         result = redact_file_content("hello world this is safe")
         assert result == "hello world this is safe"
 
+    def test_git_sha_not_redacted(self):
+        """BUG-035: a bare git commit SHA must not be mangled."""
+        from backend.secret_redactor import redact_file_content
+        sha = "a1b2c3d4e5f60718293a4b5c6d7e8f9012345678"
+        text = f"commit {sha}\nMerge: {sha}"
+        assert redact_file_content(text) == text
+
+    def test_sha256_checksum_not_redacted(self):
+        from backend.secret_redactor import redact_file_content
+        digest = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        text = f"sha256:{digest}  file.tar.gz"
+        assert redact_file_content(text) == text
+
+    def test_hex_secret_in_context_is_redacted(self):
+        from backend.secret_redactor import redact_file_content
+        secret = "0123456789abcdef0123456789abcdef01234567"
+        result = redact_file_content(f"api_key={secret}")
+        assert secret not in result
+        assert "MASQUÉ" in result
+
+    def test_ambiguous_bare_hex_left_intact(self):
+        """A 40-char hex with no secret/hash keyword stays untouched."""
+        from backend.secret_redactor import redact_file_content
+        blob = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
+        text = f"value {blob} end"
+        assert redact_file_content(text) == text
+
 
 # ═══════════════════════════════════════════════════════════════════
 # Static / PWA caching (Cloudflare / mobile freshness)