Log authentication failures across the controller service (Listen,
GetLease, RequestLease, ReleaseLease, ListLeases, Register, Unregister,
Status, Dial), the Auth helpers (AuthClient, AuthExporter) which cover
all ClientService call sites, the router service, and the Python
exporter's PassphraseInterceptor.

The peer IP address is extracted from the gRPC context and included in
every auth log entry. For ClientService paths the peer is attached via
peerAddr(); for ControllerService unary handlers logContext() is called
at the start of each method so the peer propagates into all subsequent
log entries including the auth failure.

Log level: Info (not Error) is used intentionally, following the
convention established by kube-apiserver. Authentication rejections are
expected adversarial events, not controller bugs. Using Error would
conflate "something is broken in the controller" with "a caller sent a
bad token", muddying alerts. The controller-runtime/logr interface has
no native Warn level (the backend is zapr, which maps logr.Info ->
zap INFO and logr.Error -> zap ERROR with no WARN in between), so Info
at the default V=0 verbosity is the correct choice for security-relevant
but operationally normal events.

Also fix the router JWT validation gRPC status code from
codes.InvalidArgument to codes.Unauthenticated, which is the
semantically correct code for a failed authentication.

Fixes #811

- Remove duplicate auth-failure log lines from controller_service.go;
  auth helpers (AuthClient/AuthExporter) already log at the single
  ownership point, so per-RPC re-logging was noisy and redundant.
- Remove redundant ctx = logContext(ctx) calls from GetLease,
  RequestLease, ReleaseLease, ListLeases, and Register; the gRPC
  unary interceptor already enriches every unary context, and the
  stream interceptor (wrappedStream) does the same for streaming RPCs.
- Unify peer format: logContext now strips the port via
  net.SplitHostPort, matching the format used by peerAddr in auth.go,
  so the "peer" key is consistently IP-only across all log sites.
- router_service.go Stream: call logContext before authenticate so
  the peer IP is available in the router auth-failure log entry.
- auth.go peerAddr: return "unknown" on SplitHostPort failure (e.g.
  Unix domain sockets) to avoid leaking internal transport paths.

- Export PeerAddr from auth package to eliminate duplicate peer-address
  extraction logic in logContext (controller_service.go now delegates to
  auth.PeerAddr instead of duplicating the net.SplitHostPort logic)
- Remove the stale 'unable to authenticate exporter' log in Status that
  was inconsistent with all other methods; auth logging already happens
  inside AuthExporter via the auth package
- Add TestRouterAuthenticateNoTokenLeak to verify that a bogus JWT token
  value is never emitted in log output, preventing credential leakage

Go (controller/internal/service/auth/auth_test.go):
- TestPeerAddr: no peer, host:port, IPv6, bare address, empty, nil Addr,
  Unix socket — all return expected values without panics
- TestAuthClient_TokenVerificationFailure_LogsPeerAndError: verifies log
  contains 'client authentication failed', peer IP, and error text
- TestAuthClient_NamespaceMismatch_LogsClientNameAndPeer: verifies log
  includes client name, peer, and PermissionDenied
- TestAuthClient_Success_NoAuthFailureLog: no auth-failure log on success
- TestAuthExporter_*: symmetric tests for exporter auth path
- TestAuthClient_ErrorLogIncludesNoDuplicateTokenInMessage: no raw Bearer
  prefix in logs

Go (controller/internal/service/controller_service_test.go):
- TestRouterAuthenticateNoTokenLeak: now exercises the actual Stream
  logging path (logContext + logger.Info) with peer context, not just
  authenticate() alone
- TestRouterAuthenticateReturnsUnauthenticated: codes.Unauthenticated
- TestRouterAuthenticateMissingMetadata: error on missing metadata
- TestLogContext_WithPeer_EnrichesContextWithPeerIP: peer IP in log
- TestLogContext_WithoutPeer_ReturnsUnchangedContext: no peer key
- TestLogContext_IPv6Peer_StripsPort: IPv6 support
- TestLogContext_NilAddr_ReturnsUnchangedContext: no panic on nil
- TestLogContext_UnixSocket_ReturnsUnknownPeer: path not leaked
- withCapturedLog helper uses context-based logger (not global state)
  to prevent cross-test contamination

Python (session_test.py):
- test_serve_tcp_passphrase_rejected_logs_warning: verifies WARNING log
  with method name on wrong passphrase
- test_serve_tcp_passphrase_missing_logs_warning: same for missing
- test_serve_tcp_passphrase_correct_no_warning_log: no warning on success

Bugfix: PeerAddr now handles nil p.Addr without panicking.

- Extract peerAddrUnknown constant in auth_test.go (goconst)
- Break long line in session_test.py (ruff E501: 121 > 120)

- auth_test.go: remove logf.SetLogger global mutation from captureLog,
  use logf.IntoContext only (matches withCapturedLog pattern in
  controller_service_test.go). Safe for t.Parallel().
- router_service.go: wrap BearerTokenFromContext error with
  codes.Unauthenticated so all authenticate() failure paths return the
  semantically correct gRPC code.
- auth_test.go: add token leak tests for AuthClient and AuthExporter
  (replicate TestRouterAuthenticateNoTokenLeak pattern).

Auth failures on ControllerService RPCs produced no log output: the
per-RPC log lines were removed in an earlier review round in favor of
centralized logging in the auth package, but authenticateClient and
authenticateExporter still called oidc.Verify*ObjectToken directly,
bypassing the Auth struct where that logging lives.

- Add namespace-free Auth.VerifyClient/VerifyExporter that own the
  auth-failure logging; AuthClient/AuthExporter delegate to them and
  keep the namespace check, so ClientService behavior is unchanged.
- ControllerService.authenticateClient/authenticateExporter delegate
  to the auth package instead of calling oidc directly.
- Make the interceptor-applied logContext (now auth.LogContext) the
  single owner of the "peer" log key: it is always present, with
  "unknown" as the uniform fallback for missing/nil/unparsable peer
  addresses, and the auth layer no longer adds a duplicate "peer" key.
- Tests: drive real RPCs (Register, Dial, Status) and the real
  RouterService.Stream with failing auth, asserting the logged message,
  peer address, port stripping, exactly one "peer" key, and no token
  leak; cover the router authenticate success path with a signed JWT.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>