fix(server): address Copilot review on CredentialValidator

- Skip validation when credentials are None (reactivation, CredSSP)
  instead of bailing, consistent with #1150/#1155 design
- Remove username from log messages to avoid leaking sensitive data
- Keep validator error details in structured tracing field only
- Add spawn_blocking guidance to trait doc for blocking backends

Author: glamberson

crates/ironrdp-server/src/server.rs

@@ -49,7 +49,8 @@ const LISTENER_BACKLOG: u32 = 1024;
 /// pre-loaded credentials for NTLM challenge-response).
 ///
 /// Implement this trait to validate credentials against external systems
-/// (PAM, LDAP, database, etc.).
+/// (PAM, LDAP, database, etc.). For blocking backends, wrap the call in
+/// `tokio::task::spawn_blocking` to avoid stalling the async runtime.
 pub trait CredentialValidator: Send + Sync {
     /// Validate credentials received from the client.
     /// Return `Ok(true)` to accept, `Ok(false)` to reject.
@@ -905,20 +906,19 @@ impl RdpServer {
             if let Some(creds) = &result.credentials {
                 match validator.validate(creds) {
                     Ok(true) => {
-                        debug!("Credential validation succeeded for user: {}", creds.username);
+                        debug!("Credential validation succeeded");
                     }
                     Ok(false) => {
-                        warn!("Credential validation failed for user: {}", creds.username);
+                        warn!("Credential validation failed");
                         bail!("credential validation failed");
                     }
                     Err(e) => {
-                        error!("Credential validator error: {e:#}");
-                        bail!("credential validation error: {e}");
+                        error!(error = %e, "Credential validator error");
+                        bail!("credential validation error");
                     }
                 }
             } else {
-                warn!("Credential validator configured but no credentials received from client");
-                bail!("no credentials received for validation");
+                debug!("Skipping credential validation (no credentials in AcceptorResult)");
             }
         }