docs: REST pass_from_env allowlist, Microsoft login host, RC extras

[cursor]

Description

Align operator docs with already-shipped behavior: REST env-secret pass_from_env still requires explicit allowed_hosts after the loader copies into pass; Power BI/Dataverse token POST is limited to https://login.microsoftonline.com; completão rc_bench_extras reports missing_optional_dependency (not unreachable) when optional NoSQL extras are absent. EN + pt-BR pairs only; no product code change.

Type of change

• Bug fix
• New feature
• Documentation
• Refactor / maintenance
• Other (describe):

Issue linking (required)

No issue closed: docs alignment for already-shipped #2006 / #2007 / #2011 / #2012

• This PR links the issue with Closes #NNNN or documents No issue closed: above

Docs added/updated

• docs/USAGE.md + docs/USAGE.pt_BR.md — REST *_from_env prefixes vs SQL/share DEMO_DB_PASSWORD; pass_from_env YAML example; explicit allowed_hosts after loader copy; Microsoft login host constraint
• docs/TECH_GUIDE.md + docs/TECH_GUIDE.pt_BR.md — env-secret egress for pass_from_env / password_from_env / user_from_env; Power BI/Dataverse token POST host
• docs/TROUBLESHOOTING.md + docs/TROUBLESHOOTING.pt_BR.md — security(HIGH): PowerBI connector POSTs client_secret_from_env to any public token_url, same gap #1977 fixed for REST #2007 Microsoft login host row
• docs/TROUBLESHOOTING_CREDENTIALS_AND_AUTH.md + pt-BR pair — REST *_from_env still needs allowed_hosts; security(HIGH): PowerBI connector POSTs client_secret_from_env to any public token_url, same gap #1977 fixed for REST #2007 sovereign-cloud failure
• docs/ops/LAB_COMPLETAO_RUNBOOK.md + pt-BR — rc_bench_extras list/verify; RC v3 mysql/nosql/postgres/shares; missing nosql = missing_optional_dependency not unreachable

Codepaths covered

• connectors/rest_connector.py _target_loads_secrets_from_env (pass_from_env / password_from_env / user_from_env after copy into pass; prefixes API_ / REST_API_ / DATA_BOAR_)
• connectors/microsoft_identity.py login host allowlist (login.microsoftonline.com only, security(HIGH): PowerBI connector POSTs client_secret_from_env to any public token_url, same gap #1977 fixed for REST #2007)
• scripts/rc_bench_extras.py + scripts/lab-completao-host-smoke.sh (optional extras; missing_optional_dependency vs unreachable)

Knowledge gaps addressed

• REST pass_from_env still requires explicit allowed_hosts even after the env loader copies the secret into pass
• REST *_from_env prefixes are API_ / REST_API_ / DATA_BOAR_ only; SQL/share DEMO_DB_PASSWORD remains valid for those targets — do not apply REST prefixes to DB YAML
• Power BI/Dataverse token POST is only https://login.microsoftonline.com; sovereign clouds fail security(HIGH): PowerBI connector POSTs client_secret_from_env to any public token_url, same gap #1977 fixed for REST #2007
• Completão RC extras: missing optional NoSQL extras is missing_optional_dependency, not a network unreachable

🧱 Checklist de Integridade

• Python: targeted pytest on docs locale/external-link/coauthorship guards (239 passed). Full check-all / Rust clippy not required for this docs-only slice.
• Rust Core: n/a (docs only)
• Performance: n/a (docs only)
• Drift Doc: EN + pt-BR pairs updated together; no README product-pitch change.
• Léxico: pt-BR locale on the edited pairs; no pt-PT in the edited runbook.

  

---

Note

Low Risk
Documentation-only updates across paired EN/pt-BR guides; no runtime, auth, or connector behavior changes in this PR.

Overview
This PR updates operator documentation only (EN + pt-BR pairs) so it matches behavior already in the product—no code changes.

REST credential egress (#1977 / #2006): Docs now cover target-level pass_from_env, password_from_env, and user_from_env alongside auth-block env secrets. They state that auth.allowed_hosts is still required while any *_from_env key remains, even after the loader copies values into pass/user. REST env var names must use API_ / REST_API_ / DATA_BOAR_ prefixes; SQL/NoSQL/share pass_from_env (e.g. DEMO_DB_PASSWORD) is explicitly not on that list. USAGE adds a YAML example for Basic auth via user + pass_from_env; troubleshooting and credentials guides point to tests/test_rest_connector_pass_from_env_loader.py.

Power BI / Dataverse (#2007): New sections document that client-secret token POSTs are only allowed to https://login.microsoftonline.com (https, exact host, no userinfo). Sovereign-cloud hosts fail closed with #2007 before POST—separate from REST #1977.

Scan failure reasons: Troubleshooting tables add rows for #2007, missing_optional_dependency (optional extras like nosql/shares—not TCP unreachable), and expand the #1977 row for REST pass_from_env.

Lab completão: Runbooks document host-smoke prepare using scripts/rc_bench_extras.py (list/verify), RC v3 extras sync, and that missing nosql yields missing_optional_dependency (RC sentinel fail, not SKIP).

Mongo/Redis: TECH_GUIDE notes missing .[nosql] records missing_optional_dependency instead of unreachable.

^{Reviewed by Cursor Bugbot for commit e437fd0. Bugbot is set up for automated code reviews on this repo. Configure here.}