fix(cluster): make join-token tamper test robust against zero MAC bytes

The tamper tests in both nodedb-cluster and nodedb-ctl replaced the last
hex byte of the MAC with the literal "00". When the real MAC byte
happened to already be 0x00 — which occurs ~1/256 of the time — the
replacement was a no-op and the test incorrectly passed a token with an
unmodified MAC to verify_token, causing the assertion to fail.

Replace the fixed "00" substitution with XOR 0xFF, which guarantees the
byte always changes regardless of its original value.

Author: farhan-syah

nodedb-cluster/src/auth/join_token.rs

@@ -175,10 +175,13 @@ mod tests {
             .as_secs()
             + 60;
         let hex = issue_token(&secret, 1, expiry).unwrap();
-        // Flip last two hex chars (end of MAC).
+        // Flip the last MAC byte. XOR with 0xFF so it always changes even
+        // if it was already 0x00 (a fixed "00" replacement would be a
+        // no-op ~1/256 of the time, since the MAC varies with the expiry).
         let mut tampered = hex.clone();
         let len = tampered.len();
-        tampered.replace_range(len - 2..len, "00");
+        let orig = u8::from_str_radix(&tampered[len - 2..len], 16).unwrap();
+        tampered.replace_range(len - 2..len, &format!("{:02x}", orig ^ 0xFF));
         assert_eq!(
             verify_token(&tampered, &secret).unwrap_err(),
             TokenError::InvalidMac

nodedb/src/ctl/join_token.rs

@@ -82,10 +82,14 @@ mod tests {
         assert_eq!(got_node, for_node);
         assert_eq!(got_exp, expiry);
 
-        // Flip a byte in the MAC portion.
+        // Flip a byte in the MAC portion. XOR with 0xFF so the byte is
+        // guaranteed to change even if it was already 0x00 (a fixed "00"
+        // replacement would be a no-op ~1/256 of the time, since the MAC
+        // varies with the wall-clock-derived expiry).
         let mut tampered = hex.clone();
         let flip = tampered.len() - 4;
-        tampered.replace_range(flip..flip + 2, "00");
+        let orig = u8::from_str_radix(&tampered[flip..flip + 2], 16).expect("valid hex byte");
+        tampered.replace_range(flip..flip + 2, &format!("{:02x}", orig ^ 0xFF));
         assert!(tok::verify_token(&tampered, &secret).is_err());
 
         // Wrong secret.