Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: lpcox

internal/server/hmac_test.go

@@ -268,8 +268,8 @@ func TestRejectHMAC_UsesUnauthorizedContract(t *testing.T) {
 
 	rejectHMAC(w, req, "invalid HMAC signature", "signature_mismatch")
 
-	assert.Equal(t, http.StatusUnauthorized, w.Code)
-	assert.Contains(t, w.Body.String(), "invalid HMAC signature")
+assert.Equal(t, http.StatusUnauthorized, w.Code)
+	assert.JSONEq(t, `{"error":"unauthorized","message":"invalid HMAC signature"}`, w.Body.String())
 }
 
 func TestApplyHMACIfConfigured_NoSecret(t *testing.T) {