feat(auth): log rejected gitlab api credentials

What

Stacked on !1709 (merged): a Warn log per presented-and-rejected credential on the /api/gitlab/v1 guard.

The guard in !1709 (merged) answers rejections with an opaque 401 and no server-side trace, while the dispatch row it replaced logged every failed validation through auth.Middleware. On a surface with one caller and one credential, an unlogged 401 is an undiagnosable rotation or mode mismatch. This MR mirrors auth.Middleware's line:

• Rejected credentials log at Warn with the sanitized path and the bounded error.
• Anonymous probes (no credential at all) stay out of the log.
• A credential belonging to the other mode — a bearer where a service token is configured, or the dedicated header where none is — is logged as the rollout-order mistake it is.
• Exports auth.SanitizeLogValue so the guard reuses the fuzz-tested sanitizer on the attacker-controlled path instead of a copy.

Tests pin the log lines both ways (rejections log, probes and successes stay quiet) and the injection guard on the new call site.

Depends on !1709 (merged) merging first; this branch targets it and must not merge before it.

Related to #356 (closed)