Harden logging: redact sensitive headers/bodies and add redaction helper + tests

[heliosran]

Motivation

• Prevent accidental leakage of credentials/PII from upstream request and token-refresh logging by sanitizing request bodies and headers.
• Provide a single, testable helper to consistently mask tokens and sensitive keys across the codebase.

Description

• Add a centralized redaction utility (src/log_redaction.ts) exposing maskSecret, redactForLogging, and redactHeadersForLogging that masks token-like values (preserve last 4 chars) and recognizes common sensitive header/key names.
• Update src/upstream.ts to use the redaction helpers and a getSanitizedRequestBodyForLogging helper; error and failure logs now redact bodies and headers and only emit full (but redacted) diagnostics when env.VERBOSE === "true", ensuring secrets are never printed even in verbose mode.
• Update src/auth_kv.ts token-refresh logging to avoid printing the full refreshRequest and instead emit non-sensitive metadata (status, endpoint, correlation id), with optional verbose diagnostics that still use the redacted headers.
• Add unit tests test/log_redaction.spec.ts to validate maskSecret behavior and recursive/key-based redaction, including header normalization.

Testing

• Ran typecheck with npm run tsc and lint with npm run lint, both succeeded.
• Attempted the repo default tests with npm test, which fails in this environment due to the repo’s Vitest Workers config expecting wrangler.jsonc (environment-specific config), so that run reported a config-related error.
• Executed the new unit tests directly using a local Vitest node config and npx vitest --run --config vitest.unit.config.mts, and the test/log_redaction.spec.ts suite passed (3 tests).

---

Codex Task