ep_hash_auth's handleMessage hook hangs admin socket events on /settings namespace

[JohnMcLear]

Failing tests: all 7 tests in src/tests/backend/specs/admin/anonymizeAuthorSocket.ts
Reproduces in CI: Linux with Plugins, Windows with Plugins, Upgrade from latest release (all on develop @ dbd4662 after #7789 surfaced the tests)
Does NOT reproduce: Linux without plugins, Windows without plugins — passes cleanly in both.

Symptom

Every socket.emit(evt, payload) against the /settings admin namespace hangs without ever firing the matching reply event. Each test sits at the 120s mocha timeout, so 7 tests cost about 14 minutes of CI time before the job fails.

Reproduction recipe (mirrors the Linux with Plugins (24) job):

cd src
pnpm add -w ep_align ep_author_hover ep_cursortrace ep_font_color ep_font_size \
            ep_hash_auth ep_headings2 ep_markdown ep_readonly_guest \
            ep_set_title_on_pad ep_spellcheck ep_subscript_and_superscript \
            ep_table_of_contents
NODE_ENV=production npx mocha --import=tsx --require ./tests/backend/diagnostics.ts \
    --timeout 60000 tests/backend/specs/admin/anonymizeAuthorSocket.ts

Trace pointer

CI emits a deprecation warning from ep_hash_auth.handleMessage:

WARN: the `client` context property for the handleMessageSecurity and
      handleMessage hooks is deprecated; use the `socket` property instead
  at exports.handleMessage [as hook_fn]
     (.../ep_hash_auth@11.0.24/ep_hash_auth.js:222:27)
  at callHookFnAsync (.../hooks.ts:236:16)

ep_hash_auth.handleMessage is registered globally and fires for every socket message, including those bound to the /settings namespace. /settings doesn't go through PadMessageHandler, so the client context property is undefined, and the hook reads from it without guarding — the response promise never resolves and the emit/reply round-trip stalls.

Where to look

• node_modules/ep_hash_auth/ep_hash_auth.js:222 — needs to no-op when the socket is on a non-/pad namespace.
• src/node/handler/PadMessageHandler.ts:535 — deprecated client getter (separate cleanup, but flushing this would force ep_hash_auth to migrate to socket).
• src/node/handler/SocketIORouter.ts (or wherever /settings dispatches) — verify whether the handleMessage hook should even be invoked for non-pad namespaces.

Workaround

#7789 un-hid this suite from CI. As a near-term mitigation a follow-up PR will skip the suite when ep_hash_auth is loaded in the plugin registry so the rest of the with-plugins matrix can stay green. The suite still exercises the no-plugins matrix, which is where the admin socket itself is verified.

Follow-up

Once the plugin / namespace interaction is fixed (in ep_hash_auth or in Etherpad's admin socket dispatch), drop the skip gate.