Two issues found while investigating repeated "Re-authentication required for
Test player (rpi-test1): token_reset" entries appearing every ~20s.
1) Log spam. The heartbeat handler logged an INFO row every time it asked a
player to re-authenticate. A player heartbeats every ~15s and the request
repeats until the player complies, so a pending request wrote a server_log
row every few seconds (~230 rows in ~1.3h here) and buried the dashboard.
The per-heartbeat log line is removed. The request is now recorded once, at
the moment it is raised: the admin action already logs when the button is
pressed, and the automatic interval now logs at its transition. The
outstanding request stays visible in Admin -> Maintenance as
"awaiting re-auth".
2) Credential leak. verify_player_auth logged the rejected value in full
("Invalid auth code attempt: <token>"). server_log is readable in the UI and
the database, so this wrote a live bearer token to a readable store. It now
logs a 6-character prefix plus the client IP, which is enough to correlate
failures without exposing the credential.
ske087
ef85a3ca42