fix(server): preserve auth property strings

[imbajin]

Docker property escaping could change authentication strings containing boundary spaces, control bytes or Unicode. A global C locale also made the initializer misread Unicode passwords. Encode auth strings with the native reader's escapes and keep the initializer's inherited locale, while retaining the existing typed/list mappings and signing-key reuse.

The shell tests verify control-byte boundaries, minimum signing keys, configuration reuse and child locale preservation, and explicitly report when native readback is skipped. Keep Helm's existing password guard until its minimum image contains this encoder.

Validation: Java 17 formatting and reactor compilation; real HugeConfig/HS256 readback and process controls; Linux product JSON login, denied requests and same-data restart; three independent reviews. Existing accounts initialized with an incorrect password need recovery or an authenticated password change—upgrading or setting PASSWORD again does not rotate them.

Docs: Docker guide and paired apache/hugegraph-doc#517. Basic Unicode authentication, old-account recovery, and distributed/Hubble scenarios remain separate validation tasks.

Implementation overview

Conceptual illustration shared by ASF PR #3327 and org PR #302 at the same source revision. This implementation overview is not full release or deployment acceptance evidence.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 52.62%. Comparing base (68fb045) to head (76b0218).

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3327      +/-   ##
============================================
- Coverage     52.63%   52.62%   -0.01%     
- Complexity     2435     6107    +3672     
============================================
  Files           770      770              
  Lines         67694    67694              
  Branches       9172     9172              
============================================
- Hits          35631    35626       -5     
- Misses        28520    28524       +4     
- Partials       3543     3544       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[imbajin]

The head, base and all five file patches match fork #302, whose complete change was independently cross-reviewed: 8.5/10. Rechecking the current patch found no applicability-changing difference or new source blocker. Auth strings preserve spaces, Unicode and backslashes through the actual HugeConfig/JWT readback path. Omitting the key reuses existing serialized content and does not repair a previously misread key; resupply the intended key and maintain replica consistency when needed. ASF CI and deployment acceptance remain separate from the fork results.

[bitflicker64]

Blocking: no. Summary: The new auth encoder round-trips spaces, tabs, backslashes, Unicode and legacy bytes through the Commons Configuration reader, and the readback test does run in the deployment-contracts job. One gap remains from before this PR: an ASCII value with a control byte at either end still loads one character short. Two smaller notes cover the silent readback skip outside that job and the Helm space guard whose TODO this PR removes. Evidence: read the full diff at d44fd31 with docker-entrypoint.sh, HugeConfig.java, the Server Dockerfile (eclipse-temurin:17-jre-jammy, which ships iconv and od) and the Helm server template; sourced the two encoder functions from this head and read 16 values back through commons-configuration2 2.10.1 Configurations().properties() (12 pass, the 4 edge control-byte cases fail); checked the docker / deployment-contracts job log for the readback PASS lines.