config: dump every leaf config field to the startup log

[jghoman]

Summary

Previously the only startup log line was Viaduck started: source=..., routing_field=..., mode=..., destinations=N, instance=.... Investigating production behavior meant re-reading the rendered yaml or execing into the pod to confirm what delivery.flush_interval_seconds the process started with, whether append_at_least_once was actually enabled on team-2, what poll.cdc_chunk_snapshots was set to, etc.

This adds ViaduckConfig.log_summary(log) which emits one INFO line per leaf field across every section, called from main.run() right after metrics.init.

What it looks like in the log

config: source.name='megaduck-mw-prod-us'
config: source.postgres_uri_env='SOURCE_POSTGRES_URI'
config: source.data_path='s3://posthog-megaduck-mw-prod-us/'
config: source.table='events_nrt'
config: routing.field='team_id'
config: routing.key_columns=['uuid']
config: routing.seed_mode='scan'
config: poll.interval_seconds=5
config: poll.cdc_chunk_snapshots=50
config: delivery.workers=8
config: delivery.flush_interval_seconds=120
config: delivery.flush_max_rows=500000
...
config: destinations.count=1
config: destinations[0].id='team-2'
config: destinations[0].routing_value='2'
config: destinations[0].append_at_least_once=True
...

Each value is independently greppable from Loki / kubectl logs.

Secrets

log_summary touches only raw dataclass fields, never the @property accessors that resolve env vars:

• source.postgres_uri_env (env var NAME, safe) is logged
• source.postgres_uri (the resolved URI with the embedded password) is NOT
• source.properties (raw dict of env var names) is logged
• source.resolved_properties() (resolved S3 credentials) is NOT

Two dedicated tests assert this: a resolved password set into SRC_PG / DEST_QW_PG must not appear in the log, and resolved S3 access keys / secrets must not appear when their *_env references resolve to known sentinels.

Tests

• Section coverage gate — every top-level section has at least one line. Catches a new field added to ViaduckConfig without log_summary being extended (would otherwise silently miss it in the deploy log).
• One-line-per-field assertion on a spot-check of leaf fields — defends against a refactor that bundles multiple fields onto one log line.
• Per-destination indexing under destinations[i].*.
• append_at_least_once: True flows through verbatim.
• Resolved Postgres URI passwords + resolved S3 credentials never appear in the log.

419 unit tests pass (was 413, +6 new), lint + fmt clean.

Test plan

• just lint — clean
• just fmt-check — clean
• just test — 419 passed
• Post-deploy: confirm the dump appears once at viaduck startup; confirm viaduck_dest_apply_mode (from PR apply: opt-in append_at_least_once fast path for insert-only destinations #36) and the new config: destinations[0].append_at_least_once=True line are both consistent with the rendered chart values