test(router): stop a 3-char needle finding itself in ciphertext

`set() writes an encrypted envelope` proves the secret does not survive
encryption by searching the serialized envelope for it. The secret was `'shh'`,
and the envelope is base64, so the assertion fails whenever those three
characters turn up in the ciphertext by chance. CI found one:

    Expected to not contain: "shh"
    Received: "{\"_enc\":true,...\"data\":\"...BeQ2BD2anBrrdtGevHshhdI...\"}"

`vHshhdI`. The envelope was encrypted correctly and the test that proves it
encrypted failed anyway.

Roughly 1 run in 1300 for a three-character needle across ~200 base64
characters, which is frequent enough to keep costing someone an afternoon and
rare enough to be dismissed as "just re-run it" every time.

The secret is now long and distinctive, which makes a chance collision
impossible rather than unlikely. The assertion is otherwise unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: chrisbbreuer

storage/framework/core/router/tests/encrypted-session-store.test.ts

@@ -55,14 +55,22 @@ describe('EncryptedSessionStore (stacksjs/stacks#1878 Se-4)', () => {
   })
 
   test('set() writes an encrypted envelope; raw store does NOT have plaintext', async () => {
-    await store.set('sid-1', { id: 'sid-1', userId: 42, secret: 'shh' } as any)
+    /*
+     * A long, distinctive secret on purpose. This was `'shh'`, and the
+     * assertion below is a substring search over base64 ciphertext - where a
+     * three-character needle turns up by chance roughly once in a thousand
+     * runs. CI found one: `...BeQ2BD2anBrrdtGevHshhdI...` contains `shh`, so a
+     * correctly encrypted envelope failed the test that proves it encrypted.
+     */
+    const secret = 'plaintext-that-must-never-survive-encryption'
+    await store.set('sid-1', { id: 'sid-1', userId: 42, secret } as any)
 
     const raw = inner.store.get('sid-1') as Record<string, unknown>
     expect(raw._enc).toBe(true)
     expect(typeof raw.data).toBe('string')
-    // The plaintext "shh" must not appear anywhere in the envelope
+    // The plaintext must not appear anywhere in the envelope
     // (a quick "did we forget to encrypt something" check).
-    expect(JSON.stringify(raw)).not.toContain('shh')
+    expect(JSON.stringify(raw)).not.toContain(secret)
   })
 
   test('get() decrypts back to the original payload', async () => {