fix: node-renderer diagnostic improvements (#3086)

## Summary
- Add `credentials` to the sensitive-key filtering test (every other key
in `SENSITIVE_REQUEST_BODY_KEYS` already had coverage)
- Exclude `renderingRequest` from diagnostic `bodyKeys` output — it's
already reported via the `Received type:` line, so showing it again is
redundant
- Document that `renderer_http_keep_alive_timeout` should be set shorter
than the node renderer's server-side idle timeout to prevent
stale-connection errors

Fixes #3075

## Test plan
- [x] Node renderer `worker.test.ts` passes (verified locally)
- [x] RuboCop passes on `configuration.rb`
- [ ] CI green

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: changes are limited to error-message diagnostics/test
coverage in the Node renderer and comment-only documentation for a Rails
config option.
> 
> **Overview**
> **Node renderer diagnostics are tightened for malformed
`renderingRequest` requests.** The invalid-request message now omits the
`renderingRequest` key from the reported `bodyKeys` list (it’s already
described via `Received type:`), and tests assert this behavior.
> 
> **Sensitive key filtering coverage is expanded.** Tests add
`Credentials` to ensure case-insensitive filtering matches
`SENSITIVE_REQUEST_BODY_KEYS`.
> 
> **Rails config docs are clarified.**
`renderer_http_keep_alive_timeout` is now documented to be set slightly
shorter than the node renderer’s server-side idle timeout to avoid
stale-connection reuse errors (and to use HTTPX defaults when `nil`).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
f01cd0f. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved error message clarity for invalid render requests by
excluding internal keys from diagnostic output.

* **Documentation**
* Enhanced configuration documentation for HTTP keep-alive timeout
settings with recommended values and risk mitigation guidance.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: justin808

packages/react-on-rails-pro-node-renderer/src/worker.ts

@@ -180,7 +180,9 @@ const invalidRenderingRequestMessage = (body: Record<string, unknown>) => {
   } else if (renderingRequest === '') {
     renderingRequestType = 'empty string';
   }
-  const bodyKeys = Object.keys(body).filter((key) => !SENSITIVE_REQUEST_BODY_KEYS.has(key.toLowerCase()));
+  const bodyKeys = Object.keys(body).filter(
+    (key) => key !== 'renderingRequest' && !SENSITIVE_REQUEST_BODY_KEYS.has(key.toLowerCase()),
+  );
 
   return [
     'Invalid "renderingRequest" field in render request.',

packages/react-on-rails-pro-node-renderer/tests/worker.test.ts

@@ -210,6 +210,7 @@ describe('worker', () => {
     expect(res.statusCode).toBe(400);
     expect(res.payload).toContain('Invalid "renderingRequest" field in render request.');
     expect(res.payload).toContain('Received type: array.');
+    expect(res.payload).not.toMatch(/Received body keys:.*renderingRequest/);
     expect(res.payload).toContain('Likely causes: request body truncation');
   });
 
@@ -231,6 +232,7 @@ describe('worker', () => {
         AUTH_TOKEN: 'auth',
         accessToken: 'access',
         authToken: 'auth-camel',
+        Credentials: 'creds-secret',
         safeField: 'safe',
       })
       .end();
@@ -243,6 +245,7 @@ describe('worker', () => {
     expect(res.payload).not.toContain('AUTH_TOKEN');
     expect(res.payload).not.toContain('accessToken');
     expect(res.payload).not.toContain('authToken');
+    expect(res.payload).not.toContain('Credentials');
     expect(res.payload).toContain('safeField');
   });
 

react_on_rails_pro/lib/react_on_rails_pro/configuration.rb

@@ -95,6 +95,11 @@ def concurrent_component_streaming_buffer_size=(value)
 
     # Sets the keep-alive timeout (in seconds) for persistent HTTP connections to the node renderer.
     #
+    # For best results, set this value to slightly less than the node renderer's own
+    # keep-alive / idle-connection timeout. If the client-side timeout is longer than
+    # the server's, connections may be reused after the server has already closed them,
+    # resulting in stale-connection errors. If set to nil, the HTTPX default is used.
+    #
     # @param value [Numeric, nil] A positive number or nil (to use the HTTPX default)
     # @raise [ReactOnRailsPro::Error] if value is not a positive number or nil
     def renderer_http_keep_alive_timeout=(value)