reactor(opaque): normalize to OXICLOUD_AUTH_OPAQUE_* variables

tests/api/opaque_substrate.hurl

@@ -12,7 +12,7 @@
 #   1. The server booted with the OPAQUE substrate loaded — proved
 #      transitively by the fact that this suite reached the
 #      `--test-report` stage at all. `tests/common/server.env` sets
-#      `OXICLOUD_OPAQUE_MODE=migrate` + a persisted `SERVER_SETUP`;
+#      `OXICLOUD_AUTH_OPAQUE_MODE=migrate` + a persisted `SERVER_SETUP`;
 #      a boot failure (bad base64, missing setup, ciphersuite drift)
 #      would 500 every request or refuse to bind the port.
 #
@@ -191,7 +191,7 @@ jsonpath "$.error_type" == "InvalidCredentials"
 
 # ─────────────────────────────────────────────────────────────
 # Case 9 — Params publish returns enabled=true under the test
-#           env (`OXICLOUD_OPAQUE_MODE=migrate`), the current
+#           env (`OXICLOUD_AUTH_OPAQUE_MODE=migrate`), the current
 #           ciphersuite version (1 — see `docs/config/env.md`),
 #           and the fast test-only KSF params
 #           (memoryKib=8 / iter=1 / lanes=1 from server.env).

tests/common/server.env

@@ -136,12 +136,12 @@ OXICLOUD_TRUST_PROXY_CIDR=0.0.0.0/0
 # test env — real deployments call `opaque-setup` and paste the output.
 # Never reuse this value outside CI. Regenerate any time with:
 #   cargo run --bin opaque-setup
-OXICLOUD_OPAQUE_MODE=migrate
-OXICLOUD_OPAQUE_SERVER_SETUP="ZY4hAGa1MNyE7Ht+8ksLcyMmi/K2iJvxQly+DdfllUxjiH0+CjCt4hG6+9Y68jGet2L213dV0hajCbr4fXnekkWtUxqLr+butVHEksZ9NJRuZTvS6SMC73yf/yku4WUHT1NSRB2yHurAFmYn75D9wdA1VaXTuwgO/u5i1pvcsQs="
+OXICLOUD_AUTH_OPAQUE_MODE=migrate
+OXICLOUD_AUTH_OPAQUE_SERVER_SETUP="ZY4hAGa1MNyE7Ht+8ksLcyMmi/K2iJvxQly+DdfllUxjiH0+CjCt4hG6+9Y68jGet2L213dV0hajCbr4fXnekkWtUxqLr+butVHEksZ9NJRuZTvS6SMC73yf/yku4WUHT1NSRB2yHurAFmYn75D9wdA1VaXTuwgO/u5i1pvcsQs="
 # Fast Argon2id — CI machines are underpowered vs production (256 MiB
 # default would drag every test-scaffold future OPAQUE handshake in
 # Phase 1+). Matches the params used in the round-trip unit test.
-OXICLOUD_OPAQUE_KSF_MEMORY_KIB=8
-OXICLOUD_OPAQUE_KSF_ITERATIONS=1
-OXICLOUD_OPAQUE_KSF_PARALLELISM=1
+OXICLOUD_AUTH_OPAQUE_KSF_MEMORY_KIB=8
+OXICLOUD_AUTH_OPAQUE_KSF_ITERATIONS=1
+OXICLOUD_AUTH_OPAQUE_KSF_PARALLELISM=1
 

tests/e2e/fixtures/oxicloud-stack.ts

@@ -85,8 +85,8 @@ export async function startStack(): Promise<Stack> {
       // OPAQUE substrate off for the container E2E — same rationale as the
       // playwright.config.ts / playwright.coverage.config.ts overrides.
       // The Hurl suite exercises OPAQUE via server.env directly.
-      OXICLOUD_OPAQUE_MODE: 'off',
-      OXICLOUD_OPAQUE_SERVER_SETUP: '',
+      OXICLOUD_AUTH_OPAQUE_MODE: 'off',
+      OXICLOUD_AUTH_OPAQUE_SERVER_SETUP: '',
     })
     // /health is a fast liveness probe (no DB hit); 200 means the HTTP server
     // is up and sqlx migrations have completed.

tests/e2e/playwright.config.ts

@@ -71,8 +71,8 @@ export default defineConfig({
       // need the boot-time init nor the ~200 KiB WASM client. Blanking
       // the inherited commonEnv values takes the DI factory's
       // `effective_mode == Off` short-circuit.
-      OXICLOUD_OPAQUE_MODE: 'off',
-      OXICLOUD_OPAQUE_SERVER_SETUP: '',
+      OXICLOUD_AUTH_OPAQUE_MODE: 'off',
+      OXICLOUD_AUTH_OPAQUE_SERVER_SETUP: '',
     },
   },
 });

tests/e2e/playwright.coverage.config.ts

@@ -71,8 +71,8 @@ export default defineConfig({
       // WASM bundle nor the boot-time substrate init. Blank the two OPAQUE
       // env vars inherited from commonEnv so the DI factory takes the
       // `effective_mode == Off` short-circuit path.
-      OXICLOUD_OPAQUE_MODE: 'off',
-      OXICLOUD_OPAQUE_SERVER_SETUP: '',
+      OXICLOUD_AUTH_OPAQUE_MODE: 'off',
+      OXICLOUD_AUTH_OPAQUE_SERVER_SETUP: '',
     },
   },
 });