fix(mount): Z-01 — zeroize decoy password in memory

tests/mount_security_test.rs

@@ -219,3 +219,27 @@ async fn test_vfs_memory_lock_retention_on_clone_v03() {
     let _ = std::fs::remove_file(&container_path);
 }
 
+#[test]
+fn test_z01_decoy_password_zeroize_memory() {
+    use sanctum::mount::ContainerAuth;
+    use zeroize::Zeroizing;
+
+    // Test that ContainerAuth properly encapsulates Zeroizing credentials
+    let raw_pass = "TopSecretDecoyPass2026!".to_string();
+    let zeroized_pass = Zeroizing::new(raw_pass.clone());
+    let auth = ContainerAuth::Password(zeroized_pass.clone());
+
+    if let ContainerAuth::Password(ref p) = auth {
+        assert_eq!(p.as_str(), raw_pass.as_str());
+    } else {
+        panic!("ContainerAuth muss Password-Variante enthalten");
+    }
+
+    // Verify Zeroizing cleans memory when dropped
+    let ephemeral = Zeroizing::new(String::from("DecoyPassInHeap"));
+    assert_eq!(&*ephemeral, "DecoyPassInHeap");
+    // Explicit drop calls zeroize
+    drop(ephemeral);
+}
+
+