feat(observe): redact secrets in the structured logger by default

[jcsvwinston]

Summary

Closes the secrets-in-logs gap from the 2026-05-14 post-sprint audit §7 item 6 — the sibling security item to ADR-006's CSRF hardening. Designed in ADR-007.

observe.NewLogger built a slog.Handler with no ReplaceAttr — any code that logged a secret-bearing attribute (authorization, password, token, a session cookie, …) emitted it verbatim to the log sink. NewLogger now redacts by default: the value of any attribute whose key is in a curated, case-insensitive denylist is replaced with RedactionPlaceholder ([REDACTED]). Key and log-line shape are unchanged. Pure stdlib; no new dependency.

Note: stacks on the open state-close PR #61 and the CSRF PR's CHANGELOG section. If #61 merges first the rebase is trivial (state files only).

API (additive — contract baseline updated)

• observe.NewLoggerWithRedaction(level, format string, RedactionConfig) — explicit-control constructor. RedactionConfig{Disabled, ExtraKeys, Placeholder}.
• observe.DefaultRedactedKeys() — exposes the built-in denylist for runtime auditing.
• observe.RedactionPlaceholder — the default masked value.
• NewLogger keeps its exact signature and delegates to NewLoggerWithRedaction with a zero-value config.
• log_redact_extra_keys config key (lifecycle transitional) threads ExtraKeys through App.New.

There is deliberately no config key to disable redaction — turning it off requires a code-level opt-out via NewLoggerWithRedaction, so the decision surfaces in code review (the ADR-004 / WithOpenAuthz discipline).

⚠️ Behaviour change (pre-v1.0, pkg/observe stable surface)

A deployment that intentionally logged a field under a denylisted key (e.g. an opaque non-secret named token) now sees [REDACTED] there. Documented in CHANGELOG.md under Changed; contract-guardian confirmed no DEP- entry is needed (no symbol removed or renamed) — same governance trail as ADR-006.

Review-loop fixes applied in this PR

architect-reviewer PASS, code-reviewer NITS, security-auditor PASS (2 MED — both addressed below), contract-guardian PASS.

• security MED — bootstrap-password lockout. The auto-generated admin bootstrap password was logged under the key "password" — now [REDACTED], which would lock the operator out on first boot. It is now written once to stderr, deliberately bypassing the logger; the structured log records only that it happened. (pkg/app/app.go)
• security MED — denylist expansion. Added framework-relevant keys: DSN / connection strings (database_url, dsn, redis_url, connection_string, …), smtp_pass / smtp_password, aws_secret_access_key, aws_session_token, private-key-material names, provider tokens (oauth_token, github_token, slack_token, …).
• code-review — built-in collision guard. ExtraKeys can no longer silence slog's built-in attrs (time/level/msg/source) — guarded explicitly so a stray entry cannot break log pipelines.
• godoc — limitations documented. NewLogger now states redaction is key-based only: a secret interpolated into the msg string, or nested in a struct logged via slog.Any under a benign key, is not redacted.

Test plan

• pkg/observe/redact_test.go — default-key redaction, case-insensitivity, non-string value types, slog.Group nesting, WithContext / With() paths, ExtraKeys, custom placeholder, Disabled, built-in-collision guard, DefaultRedactedKeys sorted + copy-semantics, built-in attrs pass through.
• go test ./... — clean.
• go test ./contracts/ — freeze green; 7 new pkg/observe symbols + log_redact_extra_keys[] config key added to the baselines, correctly sorted.
• go vet ./pkg/observe/ ./pkg/app/ — clean.

🤖 Generated with Claude Code