[argszero]

Summary

POST /api/sharings panicked on any multi-byte key. mask_upstream_key
(src/routes/sharing.rs) sliced the key by byte — &key[..2] and
&key[key.len() - 4..] — without a char-boundary check. The key is supplied
verbatim by the caller (sharing::create), so a key such as 中中中 (9 bytes)
or aa中中 (8 bytes) crashes the handler:

panicked at src/routes/sharing.rs:57:26:
end byte index 2 is not a char boundary; it is inside '中' (bytes 0..3 of string)
panicked at src/routes/sharing.rs:58:24:
start byte index 4 is not a char boundary; it is inside '中' (bytes 2..5 of string)

Masking is now performed over chars; the ASCII output is byte-for-byte
unchanged (sk-realsecret1234 -> sk-****1234).

The sibling helper auth::mask_api_key has the same shape but only ever
receives server-generated keys (atk_live_ + hex), so it is left untouched.

Related Issue

(none — found during internal review)

Changes

• mask_upstream_key truncates by char instead of by byte (src/routes/sharing.rs)
• no config / data-structure change

Tests

• cargo test 全部通过 (188 passed; was 187)
• cargo fmt --check 通过
• 新增/更新了单元测试: mask_upstream_key_is_char_boundary_safe — covers the helper (multi-byte short/long keys + ASCII unchanged) and a real POST /api/sharings with a non-ASCII key

Checklist

• 分支命名符合约定 (fix/)
• Commit message 使用 Conventional Commits 格式
• 单一职责，改动最小化