fix: address code review and CodeQL feedback in tests

tests/test_proposals.py

@@ -79,7 +79,7 @@ async def test_run_http_error_returns_none(settings, mock_llm):
 
 @pytest.mark.asyncio
 async def test_fetch_sends_bearer_token(settings, mock_llm):
-    """_fetch() should include ****** when api_key is configured."""
+    """_fetch() should include an Authorization header when api_key is configured."""
     with respx.mock:
         route = respx.get("https://example.com/api/status").mock(
             return_value=httpx.Response(200, text="data")
@@ -101,6 +101,6 @@ def test_proposal_format_for_telegram():
         generated_at=datetime(2026, 1, 1, 8, 0, 0, tzinfo=UTC),
     )
     text = p.format_for_telegram()
-    assert "https://example.com" in text
+    assert p.source_url in text
     assert "All good." in text
     assert "2026-01-01" in text