Authenticate from mounted secrets and stop passing the password to seaf-cli

The password could only be given through the PASSWORD variable, so Docker
Compose and Swarm secrets were unusable and the password sat in the container
environment.

PASSWORD_FILE and TOKEN_FILE read a secret from a mounted file. Only trailing
newlines are stripped, since secret files are usually written with one and a
password that silently carries it just fails to authenticate; everything else,
including surrounding spaces, belongs to the secret. Setting both a variable
and a file for one secret is rejected rather than resolved by precedence,
because the two are meant to be the same value and quietly picking one hides
the mistake until authentication fails.

The installed seaf-cli supports token authentication and ignores the password
when a token is given, so sync now passes -T instead of -p. The account
password no longer appears in any command line. The token does, because
seaf-cli accepts credentials only as arguments, but a token can be revoked on
the server. This is documented in the README.

Both secrets are masked before a command is logged.

Tests cover newline handling, empty and missing files, conflicting sources,
and that neither secret reaches the logs. Requests are now blocked in tests:
the client retries with backoff, so a test that reached the network appeared
to hang instead of failing.

tests/test_secrets.py

@@ -0,0 +1,82 @@
+"""Secrets may come from a variable or a mounted file, never ambiguously."""
+
+import pytest
+
+from dsc.errors import ConfigError
+from dsc.secrets import read_secret_file, resolve_secret
+
+
+def write(tmp_path, content, name="secret"):
+    path = tmp_path / name
+    path.write_text(content)
+    return str(path)
+
+
+@pytest.mark.parametrize("content, expected", [
+    ("s3cret", "s3cret"),
+    # Secret files are usually written with a trailing newline; a password
+    # that silently includes it fails to authenticate with no useful message.
+    ("s3cret\n", "s3cret"),
+    ("s3cret\r\n", "s3cret"),
+    ("s3cret\n\n", "s3cret"),
+    # Everything else is part of the secret, including inner and edge spaces.
+    ("  s3cret  ", "  s3cret  "),
+    ("pa ss", "pa ss"),
+    ('pa"ss$(id)`x`', 'pa"ss$(id)`x`'),
+    ("паssшörд\n", "паssшörд"),
+])
+def test_read_secret_file_strips_only_trailing_newlines(tmp_path, content, expected):
+    assert read_secret_file(write(tmp_path, content)) == expected
+
+
+@pytest.mark.parametrize("content", ["", "\n", "\r\n", "\n\n"])
+def test_read_secret_file_rejects_an_empty_secret(tmp_path, content):
+    with pytest.raises(ConfigError):
+        read_secret_file(write(tmp_path, content))
+
+
+def test_read_secret_file_reports_a_missing_file(tmp_path):
+    missing = str(tmp_path / "absent")
+    with pytest.raises(ConfigError) as err:
+        read_secret_file(missing)
+    assert missing in str(err.value)
+
+
+def test_read_secret_file_never_puts_the_secret_in_the_error(tmp_path):
+    path = write(tmp_path, "")
+    with pytest.raises(ConfigError) as err:
+        read_secret_file(path)
+    assert "empty" in str(err.value).lower()
+
+
+def test_resolve_secret_prefers_nothing_when_neither_is_set():
+    assert resolve_secret("PASSWORD", None, None) is None
+
+
+def test_resolve_secret_reads_the_variable():
+    assert resolve_secret("PASSWORD", "s3cret", None) == "s3cret"
+
+
+def test_resolve_secret_reads_the_file(tmp_path):
+    path = write(tmp_path, "s3cret\n")
+    assert resolve_secret("PASSWORD", None, path) == "s3cret"
+
+
+def test_resolve_secret_rejects_two_sources_for_one_secret(tmp_path):
+    path = write(tmp_path, "s3cret")
+    with pytest.raises(ConfigError) as err:
+        resolve_secret("PASSWORD", "other", path)
+    assert "PASSWORD" in str(err.value)
+    assert "PASSWORD_FILE" in str(err.value)
+
+
+def test_resolve_secret_conflict_message_hides_both_values(tmp_path):
+    path = write(tmp_path, "file-secret")
+    with pytest.raises(ConfigError) as err:
+        resolve_secret("PASSWORD", "env-secret", path)
+    assert "env-secret" not in str(err.value)
+    assert "file-secret" not in str(err.value)
+
+
+def test_resolve_secret_treats_an_empty_variable_as_unset():
+    assert resolve_secret("PASSWORD", "", None) is None