test(auth): polish token utility tests + docstring (Stage 1 PR1)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/packages/harness/deerflow/auth/tokens.py

@@ -2,9 +2,9 @@
 
 Format is irreversible once business systems integrate (spec D5):
 ``dfk_live_<24>`` / ``dfk_test_<24>``. The public ``key_prefix`` is the
-first 16 chars (``dfk_live_`` + 7 random) and is stored UNIQUE for audit
+leading slice of the plaintext (``dfk_live_`` plus a few random chars,
-logging; the DB only ever stores ``sha256(plaintext)`` hex, never the
+length ``_PREFIX_LEN``) and is stored UNIQUE for audit logging; the DB
-plaintext.
+only ever stores ``sha256(plaintext)`` hex, never the plaintext.
 """
 
 from __future__ import annotations

backend/tests/test_tokens.py

@@ -28,6 +28,7 @@ def test_generate_live_key_shape():
 def test_generate_test_key_prefix_env():
     key = generate_api_key("test")
     assert key.plaintext.startswith("dfk_test_")
+    assert len(key.plaintext) == 33
     assert key.prefix.startswith("dfk_test_")
 
 
@@ -43,7 +44,7 @@ def test_two_keys_are_unique():
     assert a.key_hash != b.key_hash
 
 
-def test_hash_is_deterministic_and_not_reversible():
+def test_hash_api_key_is_sha256_and_deterministic():
     plaintext = "dfk_live_abcdefghijklmnopqrstuvwx"
     h1 = hash_api_key(plaintext)
     h2 = hash_api_key(plaintext)