fix(v2): fence execution leases and redact progress

tests/integration/test_sources_jobs.py

@@ -12,7 +12,9 @@ PASSWORD = "correct-horse-battery-staple"
 
 
 async def login(client: httpx.AsyncClient) -> dict[str, str]:
-    response = await client.post("/api/v2/setup", json={"username": "admin", "password": PASSWORD})
+    response = await client.post(
+        "/api/v2/setup", json={"username": "admin", "password": PASSWORD}
+    )
     assert response.status_code == 201
     return {"X-CSRF-Token": client.cookies["backup_tool_csrf"]}
 
@@ -47,7 +49,9 @@ async def test_local_source_probe_archive_and_repository_targeted_job(
     async with app.state.engine.begin() as connection:
         await connection.run_sync(Base.metadata.create_all)
     transport = httpx.ASGITransport(app=app)
-    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+    async with httpx.AsyncClient(
+        transport=transport, base_url="https://test"
+    ) as client:
         headers = await login(client)
         repository = await client.post(
             "/api/v2/repositories",
@@ -95,14 +99,16 @@ async def test_local_source_probe_archive_and_repository_targeted_job(
         )
         assert duplicate.status_code == 409
         assert duplicate.json()["code"] == "execution_active"
-        polled = await client.get(f"/api/v2/executions/{execution.json()['id']}", headers=headers)
+        polled = await client.get(
+            f"/api/v2/executions/{execution.json()['id']}", headers=headers
+        )
         assert polled.status_code == 200
         assert polled.json()["state"] == "queued"
         cancellation = await client.post(
             f"/api/v2/executions/{execution.json()['id']}/cancel", headers=headers
         )
         assert cancellation.status_code == 202
-        assert cancellation.json()["state"] == "cancelling"
+        assert cancellation.json()["state"] == "cancelled"
         async with app.state.sessions() as db:
             stored = await db.get(Execution, execution.json()["id"])
             assert stored is not None