fix(19): WR-05 add no-echo tests for admin create-member and me password hook sites

apps/api/tests/routes/admin.test.ts

@@ -1036,4 +1036,29 @@ describe('POST /api/admin/members', () => {
     expect(adminRow).toBeDefined();
     expect(adminRow!.hasLocalCredential).toBe(false);
   });
+
+  it('WR-05 (no-echo): malformed create-member body never echoes the submitted password or Zod received field', async () => {
+    const adminId = await seedUser('admin-create-noecho', true);
+    currentDevUserId = adminId;
+    const app = await getApp();
+
+    // initialPassword too short (< 8) → Zod rejects. The noEchoHook must return only
+    // { error: 'Invalid request' } and NEVER leak the submitted password or Zod's
+    // issues[].received field (T-19-06 / the T-19-14 leak this guards against).
+    const submittedPassword = 'shortpw-secret';
+    const res = await app.fetch(
+      jsonRequest('POST', '/api/admin/members', {
+        displayName: 'No Echo',
+        username: `noecho-${randomUUID()}`,
+        initialPassword: submittedPassword.slice(0, 3), // 3 chars — fails min(8)
+      }),
+    );
+    expect(res.status).toBe(400);
+    const bodyText = await res.text();
+    expect(bodyText).not.toContain('received');
+    expect(bodyText).not.toContain('issues');
+    expect(bodyText).not.toContain(submittedPassword.slice(0, 3));
+    const parsed = JSON.parse(bodyText) as { error: string };
+    expect(parsed.error).toBe('Invalid request');
+  });
 });