Refuse a credential in a log entry and take a full 256 KiB value with its expect header (ADR 0297 review)

A log keeps what it is given for good, so the state guard against secrets
applies to it too; the stream holds 260 KiB a message so the headers an
append carries never push a 256 KiB value over.

node-tools/internal/meshtest/meshtest.go

@@ -234,7 +234,7 @@ func (m *Mesh) Bucket(t *testing.T, name string) nats.KeyValue {
 
 // Log makes a module's log afresh as the controller does from the catalogue (novox/hq ADR 0297): a file
 // stream named LOG_<module>_<name> on mesh.log.<module>.<name>.>, limits retention, no age, no cap per
-// key, the declared cap, 256 KiB an entry, refusing new entries when full, direct get, no delete or
+// key, the declared cap, 260 KiB a message (a 256 KiB value and its headers), refusing new entries when full, direct get, no delete or
 // purge. It answers the membership entry the controller issues for it.
 func (m *Mesh) Log(t *testing.T, module, name string, maxBytes int64) bus.LogIssued {
 	t.Helper()
@@ -243,7 +243,7 @@ func (m *Mesh) Log(t *testing.T, module, name string, maxBytes int64) bus.LogIss
 	_ = m.js.DeleteStream(stream)
 	if _, err := m.js.AddStream(&nats.StreamConfig{Name: stream, Subjects: []string{subject + ".>"},
 		Storage: nats.FileStorage, Retention: nats.LimitsPolicy, MaxAge: 0, MaxMsgsPerSubject: -1,
-		MaxBytes: maxBytes, MaxMsgSize: 256 * 1024, Discard: nats.DiscardNew, AllowDirect: true,
+		MaxBytes: maxBytes, MaxMsgSize: 260 * 1024, Discard: nats.DiscardNew, AllowDirect: true,
 		DenyDelete: true, DenyPurge: true, Replicas: 1,
 		Description: module + "'s log " + name + ", kept as its record (novox/hq ADR 0297)"}); err != nil {
 		t.Fatal(err)