watcher config block: dotted-path values are literal strings (missing HOCON substitution) — watcher auto-detects ApiKeyAuth from garbage, and watcher paths are outside sanitize coverage

[fupelaqu]

Found during Story REPL.2 (#162) review; verified against core/src/main/resources/softnetwork-elastic.conf on main.

Problem

The builtin elastic.watcher block intends to inherit from elastic.credentials but omits the HOCON substitution syntax:

method       = elastic.credentials.method        # literal STRING "elastic.credentials.method"
username     = elastic.credentials.username      # literal STRING
password     = elastic.credentials.password      # literal STRING
api-key      = elastic.credentials.api-key       # literal STRING
bearer-token = elastic.credentials.bearer-token  # literal STRING

In HOCON an unquoted dotted path on the right-hand side is just a string value — inheritance requires ${elastic.credentials.method}. Consequences:

1. Garbage credentials: watcher.api-key is the non-empty string "elastic.credentials.api-key", so once REPL: environment variables AND conf/application.conf are both ignored — only CLI flags configure the connection #162's auth auto-detection is active (ElasticAuthMethod.fromCredentials prefers api-key), any watcher client built from this block would send a nonsense Authorization: ApiKey … header (base64 of the literal path string) instead of no auth or the main credentials.
2. No inheritance: setting ELASTIC_CREDENTIALS_* / elastic.credentials.* never propagates to the watcher; only the ELASTIC_WATCHER_* env vars work.
3. Outside sanitize coverage: REPL.2 (REPL.2 — Connection config precedence: CLI flag > env var > config file > default #165) introduced empty/whitespace-env sanitization for the elastic.credentials.* paths; the elastic.watcher.* paths got no equivalent treatment.

Fix

• Replace the five literals with real substitutions (method = ${elastic.credentials.method} etc. — note method may be absent after REPL.2 — Connection config precedence: CLI flag > env var > config file > default #165, so use optional inheritance consistent with the auto-detect design).
• Extend the REPL.2 — Connection config precedence: CLI flag > env var > config file > default #165 sanitize/precedence treatment to the elastic.watcher.* paths.
• Test: watcher config resolves main credentials when ELASTIC_WATCHER_* unset; auto-detection yields no-auth when nothing is set anywhere.

Should ride the 0.20.2 line. Refs #162, #165, #169.

[fupelaqu]

Fix is up: PR #175 (branch fix/172-watcher-substitutions). It is stacked on feature/REPL.2 (PR #165) because it extends that story's sanitize layer to the watcher paths — so its base is feature/REPL.2, not main, and GitHub will only show the linked-PR badge / auto-close once #165 merges and #175 retargets main. Merge order: #165 → #175.